cyber.hendryadrian.com
Threat Research · thehackernews.com

Transparent Tribe Uses Rust Backdoor and Private GitHub Repositories in Operation RapidRust

· Original article ↗

Summary

Zscaler researchers attribute Operation RapidRust attacks on government and defense entities in India and Afghanistan to Transparent Tribe, describing Rust malware, private GitHub C2, file stealers and USB propagation.

Key points

  • Zscaler researchers attribute the campaign to Transparent Tribe, also known as APT36 and Earth Karkaddan; targets include government and defense organizations in India and Afghanistan.
  • RUSTYSHADE is a Rust backdoor that uses attacker-controlled private GitHub repositories and the GitHub REST API for encrypted, bidirectional C2, command output and data transfer.
  • RUSTYSHADE can run background commands, take screenshots and webcam photos, and perform file operations.
  • PSNATCH for Windows and BASHNATCH for Linux search for files in configured directories and exfiltrate selected files; PSNATCH has per-file and per-execution collection limits.
  • RUSTYMOVE monitors removable drives and copies staged files, including a ZIP containing RUSTYSHADE and a shortcut suspected of launching it.
  • The campaign also used typosquatted domains theprints[.]org and indiatodays[.]org to host malicious PowerShell content and payloads.
  • Researchers said a significant portion of activity occurred from August 20 to September 1, 2026, with C2 commands issued on weekdays between 4 a.m. and 11 a.m. UTC.

Article Details

Attack Vectors
  • Typosquatted domains impersonating Indian news organizations hosted malicious PowerShell scripts and payloads.
  • RUSTYSHADE used attacker-controlled private GitHub repositories for encrypted command-and-control communication.
  • PSNATCH and BASHNATCH collected files from Windows and Linux systems and exfiltrated them to private repositories.
  • RUSTYMOVE monitored for removable media and copied pre-staged malicious files to detected drives, enabling USB-based propagation.

Indicators of compromise

TypeIndicatorContext
DOMAINindiatodays[.]orgTyposquatted domain impersonating India Today and used to host malicious PowerShell content.
DOMAINtheprints[.]orgTyposquatted domain impersonating The Print and used to host malicious PowerShell content.

MITRE ATT&CK

T1016 · System Network Configuration DiscoveryThe article reports network reconnaissance as part of post-compromise activity.T1057 · Process DiscoveryThe article reports system reconnaissance, but does not specify its exact collection method.T1059.001 · PowerShellRUSTYMOVE monitors removable media using a PowerShell script; PSNATCH is also a PowerShell stealer.T1059.004 · Unix ShellBASHNATCH is a bash-script file stealer targeting Linux systems.T1082 · System Information DiscoveryRUSTYSHADE stores system reconnaissance data in its C2 repository.T1083 · File and Directory DiscoveryPSNATCH recursively scans preconfigured directories for files to steal.T1091 · Replication Through Removable MediaRUSTYMOVE copies pre-staged malicious files to detected external removable drives.T1113 · Screen CaptureRUSTYSHADE can capture desktop screenshots.T1125 · Video CaptureRUSTYSHADE can capture webcam photos.T1567.001 · Exfiltration to Code RepositoryPSNATCH and BASHNATCH exfiltrate collected files to private repositories.

People

Sudeep SinghSenior manager of APT Research at Zscaler ThreatLabz; quoted describing the campaign.

Threat Actors

APT36Name identified by the article as an alias of Transparent Tribe, which it attributes with the reported attacks.Transparent TribeGroup attributed with the campaign targeting government and defense entities in India and Afghanistan; the article identifies APT36 and Earth Karkaddan as aliases.

Malware

BASHNATCH#TransparentTribeGITSHELLPADIt shares some level of functionality overlap with GITSHELLPAD, a Golang implant that was observed in September 2025 in connection with a campaign known as Gopher Strike.PATCHCORDAfghan telecom providers and South Asian critical infrastructure organizations using a backdoor called PATCHCORD.PSNATCH#TransparentTribeRUSTYMOVE#TransparentTribeRUSTYSHADE#TransparentTribe

Products

GitHubThe campaign relies on private GitHub repositories, Rust-based backdoors, and cross-platform stealers to support stealthy command-and-control, data theft, and USB-based propagation.

Countries

AfghanistanTransparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains.IndiaTransparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains.

Industries

Critical infrastructurepersistent threat group to another campaign aimed at Afghan telecom providers and South Asian critical infrastructure organizations using a backdoor called PATCHCORD.DefenseTransparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains.GovernmentTransparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains.

Related Articles