APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks

APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government environments.

The operation, called RapidRust, targets India and Afghanistan with a backdoor, file stealers, and a USB-spreading tool. This approach is important because air-gapped networks are separated from the internet to protect sensitive systems.

A USB drive can still bridge that physical divide when it moves between an infected computer and a restricted one, a risk also illustrated by reports on GoldenJackal air-gap attacks.

Analysts at Zscaler identified the activity in August 2026 and attributed it to APT36. The toolkit can steal documents, survey local networks, and reach systems without internet connectivity.

Zscaler said in a report shared with Cyber Security News (CSN) that the campaign blends private GitHub repositories, cloud-hosted payloads, and lookalike domains that mimic Indian media outlets. Those choices can help activity blend into web use.

The campaign also shows how a small propagation utility can create serious exposure in controlled settings. It can let a user transport infection across a security boundary.

This is especially relevant for offices where classified records move between administrative workstations and isolated operational systems, because one unvetted drive can undermine that separation during routine device transfers.

APT36 Uses USB-Spreading Malware

At the center of this phase is RUSTYMOVE, a lightweight Windows program written in Rust. Once installed on a compromised computer, it continually watches for USB, SD, MMC, and IEEE 1394 removable devices, checking again every two seconds for new media.

When it finds a drive, the tool copies two prepared files to its root folder: an archive containing the RUSTYSHADE backdoor and a shortcut disguised as a PDF document.

Researchers assess with high confidence that opening the shortcut runs the archived backdoor after extraction, turning the removable drive into a delivery mechanism.

RUSTYMOVE tracks a drive’s unique identifier so it does not repeatedly copy the same files. It has no built-in network command channel or hidden payload of its own, which suggests its narrow role is to spread the attack.

Similar USB-borne tradecraft featured in Mustang Panda SnakeDisk campaign, underlining why isolation alone is not a complete safeguard.

APT36 also created a logon-triggered scheduled task named StandAloneOneDriveUpdater-2626 to start the tool and make it resemble an updater.

Defenders should restrict removable media on sensitive systems, require approved and scanned devices, and investigate unexpected shortcut files, archives, and scheduled tasks running from public-user directories.

Backdoor and Data Theft Tools

The USB component works alongside RUSTYSHADE, a 64-bit Rust backdoor that uses attacker-controlled private GitHub repositories for commands and stolen data.

It encrypts communications, allowing the operator to request directory listings, run shell commands, capture screenshots, take webcam images, and upload files.

The use of a development platform as a control channel can complicate monitoring if organizations treat all GitHub traffic as harmless. That technique has appeared in campaigns, including GitHub infrastructure abuse campaign, making repository API access worth reviewing.

APT36 also used PSNATCH for Windows and BASHNATCH for Linux to search folders, removable-drive letters, and recent files before sending data to private repositories.

PSNATCH limits collection by file size and tracks previously uploaded material, which helps it make smaller follow-up transfers instead of repeatedly taking the same data.

After gaining access, operators ran commands to identify users, processes, connected machines, shares, and reachable systems.

They then tested network services and attempted connections to remote administrative shares, a sequence that shows the campaign is designed to expand beyond its first victim.

Security teams should block the listed domains and URLs, hunt for the named artifacts, and examine unusual PowerShell activity, GitHub API use, and suspicious cloud-storage downloads.

Network segmentation and controls on removable media are especially important where government or defense systems must remain offline.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File hash	40a75f87f1e52c33df9ca733aaf8ebbb00aff1a72c5d5635ab36ce2eb370718a7f0557a052d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523	DriverInstaller.zip, ZIP archive containing RUSTYSHADE
File hash	Ae77f1834ccde53258bc27a779102af2761ccb15af1c3fe6e4365ddf65578966e4c84fc980fdde0dafa450ae33937ccef752b46666da567926b2f39b37e02e77f9d6a92e	DriverInstaller.exe, RUSTYSHADE
File hash	Aade06ec611d69f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7	Automata-20.zip, ZIP archive containing RUSTYMOVE
File hash	F16f507a8ed515663a4f07050cd97a74 00e1cc0fb1355c196c069791a02b4a5f3b57ae9470fc6cba3c2021889fb4093d0221dc6925818666df25718a630c562cac18da31	Automata-20.exe, RUSTYMOVE
Payload staging domain	theprints[.]org	Domain used to stage payloads
Payload staging domain	officialinfo[.]org	Domain used to stage payloads
Payload staging domain	indiatodays[.]org	Domain used to stage payloads
Payload staging URL	theprints[.]org/adrive	Payload staging location
Payload staging URL	theprints[.]org/drivefolder	Payload staging location
Payload staging URL	theprints[.]org/mau	Payload staging location
Payload staging URL	theprints[.]org/msheets	Payload staging location
Payload staging URL	theprints[.]org/gsheets	Payload staging location
Payload staging URL	hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip	RUSTYMOVE payload archive
Payload staging URL	hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip	RUSTYSHADE payload archive

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC