Pakistan-aligned cyber-espionage group Transparent Tribe (aka APT36 or Earth Karkaddan) has unleashed a wave of new malware attacks against government and defense organizations across India and Afghanistan. The assault, dubbed Operation RapidRust by cybersecurity researchers, introduces several newly discovered tools including a Rust-based backdoor, file stealers, and utilities for moving laterally inside networks. These developments highlight how APT36 continues to evolve its tactics and techniques for more stealthy and persistent intrusions.
Four Newly Identified Malware Families
Central to the campaign is RUSTYSHADE, a backdoor written in Rust that stands out for its use of attacker-controlled private GitHub repositories as its command-and-control (C2) channel. RUSTYSHADE leverages the GitHub REST API to exchange instructions, reconnaissance data, screenshots, webcam captures, and more via specific files such as command.txt, results.txt, and heartbeat.txt. It supports functionalities like taking screenshots, capturing webcam images, performing file operations, and executing background commands. Some of its behavior overlaps with a previously observed implant called GITSHELLPAD, seen in a 2025 campaign known as Gopher Strike.
Alongside RUSTYSHADE are tools for file theft and spreading persistently: PSNATCH and BASHNATCH are file-stealing utilities for Windows and Linux respectively. They search through configured directories for documents, media, executables, archives, and scripts modified within the past three months, then exfiltrate up to 5 GB per execution via private GitHub repositories. Meanwhile, RUSTYMOVE is a USB propagation tool for Windows: it monitors for removable drives and copies two pre-placed malicious files to their root—one a ZIP archive of RUSTYSHADE, the other a shortcut file (LNK) likely set to launch the backdoor.
Tactics, Timing, and Delivery Mechanisms
This campaign also makes use of typosquatted domains mimicking Indian media outlets—such as theprints[.]org and indiatodays[.]org—to host malicious PowerShell scripts and payloads, aiding initial infection vectors. After compromising a system, APT36 follows a familiar pattern: reconnaissance of system, user, and network contexts, followed by planting secondary payloads.
Activity has been most intense between August 20 and September 1, 2026. The command-and-control operations are tightly scheduled, occurring only on weekdays between 4:00-11:00 UTC. This controlled lateness helps the threat actor minimize detection risks and exploit operational windows.
This isn’t Transparent Tribe’s first notable campaign this year. A recent operation used a backdoor called PATCHCORD targeting Afghan telecoms and critical infrastructure. The group’s continued targeting of defense and government institutions underscores an increasingly bold posture. These new tools make clear that APT36 is building a more sophisticated, modular, and evasive toolbox.
What this means. The usage of private GitHub repositories for C2 signals a shift toward abusing legitimate platforms to hide malicious activity. From an attribution standpoint, it complicates detection based on external IP patterns or traditional malware signatures. Organizations in South Asia—and beyond—must brace for attacks that exploit cloud services and code-hosting platforms. The evolution seen in Operation RapidRust highlights a trend toward cross-platform malware suites, stricter timing discipline, and looser dependence on bespoke infrastructure. Defenders should watch for GitHub repository abuse, unconventional C2 channels, and behavior-based anomalies—especially when media impersonation is involved.
