Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
The Pakistan-aligned threat group Transparent Tribe (APT36/Earth Karkaddan) is actively targeting government and defense entities in India and Afghanistan with a new campaign, Operation RapidRust. They are utilizing a suite of newly identified malware tools – RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH – leveraging private GitHub repositories for C2 communication and typosquatted domains to deploy malicious payloads. The group employs a sophisticated approach, including reconnaissance, targeted payload deployment, and a specific operational window for command issuance.
The Pakistan-aligned threat group Transparent Tribe (also known as APT36 and Earth Karkaddan) is currently engaged in a campaign targeting government and defense organizations in India and Afghanistan. This campaign, dubbed Operation RapidRust, utilizes a range of newly developed malware tools, including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. A key element of this campaign is the group's use of private GitHub repositories for command-and-control (C2) communication and the registration of typosquatted domains mimicking popular Indian news organizations like The Print and India Today to host malicious PowerShell scripts and payloads.
RUSTYSHADE is a Rust-based backdoor that utilizes attacker-controlled private GitHub repositories for encrypted C2 communications. It parses and writes specific files within the repository for bidirectional communication using the GitHub REST API, including files like `command.txt`, `results.txt`, `info.txt`, `heartbeat.txt`, `screenshot.png`, `webcam_photo.jpg`, and `download.bin`. These commands allow RUSTYSHADE to take screenshots, capture webcam photos, perform file operations, and run commands in the background.
PSNATCH and BASHNATCH are file-stealing programs designed for Windows and Linux systems, respectively. PSNATCH recursively scans preconfigured directories for Microsoft Office documents, images, archives, media, executables, scripts, and databases modified within the last three months, exfiltrating them to a private repository named after the infected machine, with a file size limit of 1 GB per file and 5 GB per execution. BASHNATCH is a bash script similar to PSNATCH, targeting Linux systems.
RUSTYMOVE is a lightweight 64-bit Windows USB propagation tool developed in Rust. Its primary function is to continuously monitor for external removable media using a PowerShell script and copy two pre-staged malicious files – `DriverInstaller.zip` (containing RUSTYSHADE) and `DocScanner-11-Aug-2026-5-37pm.pdf.LNK` (suspected to contain a command to execute RUSTYSHADE after extraction) – to the root directory of each detected external drive.
Post-compromise activity involves system, user, and network reconnaissance, followed by the deployment of next-stage payloads. The campaign’s activity was concentrated between August 20 and September 1, 2026, with C2 commands issued primarily between 4 a.m. and 11 a.m. UTC and only on weekdays.