"APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan," Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz, said in a technical report published this week.
RUSTYSHADE: a Rust backdoor using private GitHub repositories for C2
Zscaler ThreatLabz attributed a fresh set of attacks against government and defense entities in India and Afghanistan to the Pakistan-aligned group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan). Central to the campaign — codenamed Operation RapidRust — is RUSTYSHADE, a Rust-based backdoor that uses private GitHub repositories for encrypted command-and-control (C2) communications.
RUSTYSHADE implements bidirectional communication by parsing and writing specific files in the attacker-controlled private GitHub repository via the GitHub REST API. Zscaler identified the repository filenames used for different functions:
- command.txt — stores encrypted C2 commands
- results.txt — stores encrypted command output
- info.txt — stores system reconnaissance data
- heartbeat.txt — keepalive beaconing to confirm active infection
- screenshot.png — encrypted desktop screenshot
- webcam_photo.jpg — encrypted webcam capture
- download.bin — encrypted exfiltrated file contents
Allowed commands observed in RUSTYSHADE include taking screenshots, capturing a webcam photo, performing file operations, and running commands in the background. Zscaler noted functionality overlap between RUSTYSHADE and GITSHELLPAD, a Golang implant observed in September 2025 in connection with a campaign called Gopher Strike.
PSNATCH and BASHNATCH: Windows and Linux file stealers fetched from GitHub Gists
As part of post-compromise activity, APT36 operators were observed fetching a file stealer from an attacker-controlled GitHub gist. Zscaler identified two variants intended for Windows and Linux hosts:
- PSNATCH — a PowerShell stealer that recursively scans preconfigured directories for Microsoft Office documents, images, archives, media, executables, scripts, and databases modified within the last three months. Collection is limited to 1 GB per file and 5 GB per execution. The stolen data is exfiltrated to a private repository named after the infected machine.
- BASHNATCH — a bash script functionally similar to PSNATCH for Linux systems.
The use of GitHub gists and private repositories for staging and exfiltration is a notable element tying tooling and infrastructure choices throughout the campaign.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageRUSTYMOVE: USB propagation using pre-staged malicious payloads
Another newly identified tool, RUSTYMOVE, is a lightweight 64-bit Windows USB propagation utility written in Rust. Its observed behavior is straightforward: a PowerShell script continuously monitors for external removable media and copies two pre-staged malicious files to the root directory of each detected drive:
- DriverInstaller.zip — contains RUSTYSHADE
- DocScanner-11-Aug-2026-5-37pm.pdf.LNK — suspected to contain a command to execute RUSTYSHADE after extraction
By placing an archive and an LNK file on removable media, the operators create a chance for users to execute the backdoor after interacting with what appears to be a document scanner file.
Operational cadence, targeting, and related activity
Zscaler's timeline places a significant portion of the observed actions between August 20 and September 1, 2026. C2 traffic associated with the campaign was issued only between 4 a.m. and 11 a.m. UTC and only on weekdays. Targets are described as government and defense organizations in India and Afghanistan.
The discovery follows a separate finding by Acronis Threat Research Unit (TRU) — reported a little over a month earlier — that tied the group to a campaign aimed at Afghan telecom providers and South Asian critical infrastructure using a backdoor called PATCHCORD. Additional infrastructure in the RapidRust campaign included typosquatted domains impersonating Indian news outlets to host malicious PowerShell scripts and payloads, specifically theprints[.]org and indiatodays[.]org, which mimic The Print (theprint[.]in) and India Today (indiatoday[.]in), respectively.
What this means for government and defense organizations, telecom providers, and security teams
- Government and defense organizations: The campaign demonstrates tailored targeting of these sectors in India and Afghanistan, with tooling designed to support both remote C2 via private GitHub repositories and local propagation via removable media. Those organizations will likely need to scrutinize both network-based repository access and removable media usage policies.
- Telecom providers and critical infrastructure (as signaled by Acronis TRU's earlier finding): Operators in the region should watch for similar overlaps in tooling and infrastructure, including the reuse of backdoors such as PATCHCORD alongside newly observed implants.
- Security teams and incident responders: Detection strategies should account for unusual use of private GitHub repositories and gists for C2 and exfiltration, the specific repository filenames RUSTYSHADE uses, the PSNATCH/BASHNATCH collection behavior and limits, and USB propagation patterns exemplified by RUSTYMOVE.
Operation RapidRust underscores a clear trend in the campaign observed by Zscaler: APT36 continues to update its toolkit and operational habits, combining cloud-hosted private repositories with hands-on propagation techniques. As Sudeep Singh observed, that high operational tempo and evolving TTPs are focused on government and defense targets in India and Afghanistan.
