Breaches and incidents
Transparent Tribe / APT36 (India): Operation RapidRust Rust backdoor uses private GitHub repos for C2 against government and defence
Zscaler ThreatLabz documented four new tools used against government and defence organisations in India and Afghanistan, with most post-compromise activity...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Zscaler ThreatLabz documented four new tools used against government and defence organisations in India and Afghanistan, with most post-compromise activity from 20 Aug to 1 Sep 2026: RUSTYSHADE (Rust Windows backdoor: screenshots, webcam, shell), RUSTYMOVE (copies a ZIP and LNK to USB drives, which could reach air-gapped networks), PSNATCH (PowerShell stealer for files modified in the last 120 days) and BASHNATCH (Linux counterpart).
- Technique: typosquatted Indian news domains theprints[.]org and indiatodays[.]org hosted PowerShell stages; RUSTYSHADE talks to private GitHub repositories through the REST API with a hard-coded personal access token and AES-256-GCM messages; PSNATCH creates one private repo per victim; persistence via scheduled tasks named like OneDrive/Edge updaters; operators worked weekdays 04:00 to 11:00 UTC. Initial access not described.
- Attacker: APT36 (Pakistan-nexus) per Zscaler.
- Response: IOCs published.