The Pakistan-aligned threat group Transparent Tribe — tracked by security researchers as APT36 and Earth Karkaddan — has launched a fresh wave of cyberattacks against government and defense organizations in India and Afghanistan. Researchers at Zscaler ThreatLabz, who named the campaign Operation RapidRust, say the group has deployed four previously undocumented tools written partly in Rust, a programming language increasingly favored by threat actors for its speed and difficulty to reverse-engineer.
The most notable new tool is RUSTYSHADE, a Rust-based backdoor that hides its command-and-control traffic inside attacker-controlled private GitHub repositories. Rather than communicating directly with a server the defenders can block, the malware reads and writes encrypted files (command.txt, results.txt, heartbeat.txt, and others) through GitHub’s REST API — blending its traffic with the millions of legitimate GitHub requests made every day. A companion tool called RUSTYMOVE spreads the infection to other machines via USB drives. Two file stealers — PSNATCH for Windows and BASHNATCH for Linux — collect Office documents, images, and archives modified in the last three months and exfiltrate them to another private repository named after the victim machine.
APT36 also registered lookalike domains impersonating Indian news outlets — theprints[.]org (mimicking The Print) and indiatodays[.]org (mimicking India Today) — to host malicious PowerShell scripts. The campaign was most active between August 20 and September 1, 2026, with C2 commands issued only on weekdays and only between 4 a.m. and 11 a.m. UTC, consistent with operator business hours in Pakistan.
Sources
- Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 — The Hacker News / Zscaler ThreatLabz