APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.
Zscaler identified in August 2026 a campaign tracked as RapidRust in which APT36 uses infected removable drives to reach air-gapped government environments in India and Afghanistan. RUSTYMOVE, a Rust USB-spreading utility, copies a fake-PDF shortcut and the RUSTYSHADE backdoor to removable media; RUSTYSHADE uses attacker-controlled private GitHub repositories for C2, running shell commands, capturing screenshots and webcam images, while PSNATCH and BASHNATCH steal files. Operators enumerated users, shares, and remote administrative shares to expand beyond initial victims, with payloads staged on lookalike domains mimicking Indian media outlets and Backblaze B2 storage.
- RUSTYMOVE polls removable devices every two seconds and drops payloads via disguised shortcuts
- RUSTYSHADE backdoor uses private GitHub repos for C2, stealing files, screenshots, and webcam captures
- Logon-triggered scheduled task StandAloneOneDriveUpdater-2626 launches the USB spreader
- Operators enumerate users, processes, and admin shares to expand beyond the first victim
- IoCs include file hashes, lookalike domains like indiatodays[.]org, and Backblaze staging URLs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | backblazeb2.com | ion Payload staging URL hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip RUSTYMOVE payload archive Payload staging |
| domain | indiatodays.org | [.]org Domain used to stage payloads Payload staging domain indiatodays[.]org Domain used to stage payloads Payload staging URL theprin |
| domain | officialinfo.org | [.]org Domain used to stage payloads Payload staging domain officialinfo[.]org Domain used to stage payloads Payload staging domain indi |
| domain | theprints.org | cac18da31 Automata-20.exe, RUSTYMOVE Payload staging domain theprints[.]org Domain used to stage payloads Payload staging domain offi |
| md5 | aade06ec611d69f1553035f22356ccf4 | b37e02e77f9d6a92e DriverInstaller.exe, RUSTYSHADE File hash Aade06ec611d69f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1 |
| md5 | f16f507a8ed515663a4f07050cd97a74 | Automata-20.zip, ZIP archive containing RUSTYMOVE File hash F16f507a8ed515663a4f07050cd97a74 00e1cc0fb1355c196c069791a02b4a5f3b57ae9470fc6cba3c2021889fb |
| sha1 | ad4afe86a835bb2f7768862d358ebd8324c05902 | .exe, RUSTYSHADE File hash Aade06ec611d69f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a6 |
| sha256 | 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7 | f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7 Automata-20.zip, ZIP archive containing RUSTYMOVE File hash |
| url | https://clients-easy.s3.us-east-005.backblazeb2.com/Automata-20.zip | [.]org/gsheets Payload staging location Payload staging URL hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip RUSTYMOVE payload archive Payload staging URL hxxps://f00 |
| url | https://f005.backblazeb2.com/file/Clients-easy/DriverInstaller.zip | tomata-20.zip RUSTYMOVE payload archive Payload staging URL hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip RUSTYSHADE payload archive Note: IP addresses and domains |
From the original article
4 min read at cybersecuritynews.com
APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government environments. The operation, called RapidRust, targets India and Afghanistan with a backdoor, file stealers, and a USB-spreading tool. This approach is important because air-gapped networks are separated from the internet to protect sensitive systems.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.