A Pakistan-linked espionage group known as APT36 has been observed deploying a new campaign designed to penetrate air-gapped government systems in India and Afghanistan. Dubbed Operation RapidRust, this operation merges USB-based malware, private GitHub communication backdoors, domain impersonation, and data exfiltration tools to infiltrate highly secured environments. Researchers first spotted the activity in August 2026.
Toolkit and Tactics: RUSTYMOVE, RUSTYSHADE, PSNATCH and BASHNATCH
The campaign hinges on several purpose-built tools: RUSTYMOVEcopies malicious payloads onto removable media (USB, SD, MMC, IEEE 1394) and hides a backdoor installer and a shortcut masquerading as a PDF. This tool tracks the media by its identifier to avoid redundant infections.
Once installed on a compromised machine, RUSTYSHADEacts as the backdoor. It leverages private GitHub repositories for command and control, using encrypted channels to evade typical network monitoring. It supports commands including directory tree navigation, shell command execution, screen captures, webcam snaps, and data uploads.
Two additional tools round out RapidRust’s capabilities: PSNATCH(for Windows) and BASHNATCH(for Linux) are file-stealers. They scan through directories, removable drives, and recently accessed files, then forward the harvested data to private GitHub repositories. PSNATCH tracks what it has already exfiltrated to avoid redundancy.
Delivery Methods & Infrastructure Camouflage
APT36’s delivery strategy uses domains that imitate Indian media outlets like “theprints[.]org” and “indiatodays[.]org”, among others. These mimic legitimate sites and house scripts or payloads. PowerShell downloader stages are hosted on these typosquatted domains and cloud storage (e.g., Backblaze).
Persistence is achieved via a scheduled task named StandAloneOneDriveUpdater-2626to launch RUSTYMOVE at user logon, disguised as an updater. The USB-spreading tool lacks its own network channel—its purpose is purely propagation.
Targets have been government administrative and defense-related systems. Of special concern are networks designed to be air-gapped—physically isolated to protect classified data. Regular movements of removable media between administrative and operational systems can break the isolation.
Defender Guidance and Indicators to Watch
Security teams should restrict usage of removable media on sensitive machines, enforce device approval and scanning, and scrutinize unexpected archive or shortcut files. Scheduled tasks in user directories should raise suspicion, especially those disguising themselves as legitimate updaters. Monitoring for GitHub API usage for non-standard operations, and for anomalous cloud storage downloads, is critical.
Some specific indicators include file hashes for payloads like DriverInstaller.zip/.exeand Automata-20.zip/.exe, domain names staging payloads, and URLs hosted on Backblaze storage. IoCs also reveal domains impersonating media, staging locations, and scheduled tasks.
RapidRust demonstrates that even strong physical and network defenses can be undermined with tools like removable media propagators, social engineering for domain spoofing, and hidden control channels. Detection must extend to physical artifacts—not just network signatures or endpoint protections. Threat actors continue innovating with Rust-based tooling built for resilience and stealth.
What this means:Operation RapidRust is a stark reminder that air gaps are no longer a fail-safe security boundary. Attackers are building modular toolsets that assume traditional isolation layers can be breached through everyday workflows, like USB transfers and document sharing. For defenders, it’s vital to broaden visibility beyond network logs—inventory, policy enforcement over physical media, and trusted device controls should become central to protection strategies. Watch especially for signs of propagation between isolated segments, and be alert to misuse of developer platforms like GitHub for command channels.
