Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Transparent Tribe (APT36), a Pakistan-aligned threat actor, has launched a new campaign dubbed Operation RapidRust, targeting government and defense entities in India and Afghanistan. The group deployed a Rust-based backdoor called RUSTYSHADE that uses private GitHub repositories for encrypted command-and-control (C2) communications. Additional tools include RUSTYMOVE, a USB propagation tool, and file stealers PSNATCH (PowerShell) and BASHNATCH (bash) for Windows and Linux systems. Attackers used typosquatted domains impersonating Indian news sites to host malicious payloads and conducted post-compromise activities including reconnaissance and lateral movement.

AI-extracted · verify before operational use