APT36 'Operation RapidRust' Uses New Rust Malware for Espionage

Executive Summary

The Pakistan-aligned advanced persistent threat (APT) group Transparent Tribe (also known as APT36 or Earth Karkaddan) is conducting a new cyber espionage campaign dubbed "Operation RapidRust." According to research from Zscaler ThreatLabz, the campaign targets government and defense organizations in India and Afghanistan. This operation is distinguished by its use of a new malware toolkit primarily written in the Rust programming language, designed for stealth and persistence. Key components include the RUSTYSHADE backdoor, which uses private GitHub repositories for command-and-control (C2), and RUSTYMOVE, a tool for spreading the malware via removable media. This evolution in tactics demonstrates the group's increasing sophistication and focus on evading detection.

Threat Overview

Transparent Tribe is a threat group known for its persistent espionage operations aligned with Pakistani interests, primarily targeting Indian diplomatic, military, and government entities. "Operation RapidRust" represents a significant update to their arsenal. The attacks, observed between August and September 2026, aim to establish long-term access to victim networks for intelligence gathering.

The initial infection vector involves social engineering, using typosquatted domains like theprints[.]org and indiatodays[.]org that impersonate legitimate Indian news outlets to deliver malicious payloads.

Technical Analysis

The campaign's malware suite is designed for a multi-stage attack:

1. Initial Access & Dropper: The initial payload is delivered via the typosquatted domains. Once executed, it deploys the primary backdoor.

2. RUSTYSHADE Backdoor: This is the core component, a backdoor written in Rust. Its most notable feature is the use of private GitHub repositories for C2 communications, a technique known as T1102.002 - Web Service: Bidirectional Communication. The malware uses the GitHub REST API to fetch commands from and upload exfiltrated data to the repository, encrypting the traffic with HTTPS. This makes the C2 traffic blend in with legitimate developer activity and difficult to block at the network level.

3. RUSTYMOVE Spreader: This Rust-based tool is designed for lateral movement via T1091 - Replication Through Removable Media. It monitors for newly connected USB drives, copies the RUSTYSHADE backdoor to them, and creates a LNK file to trick users into executing the malware on other systems. This is particularly effective for targeting air-gapped networks common in defense and government environments.

4. PSNATCH & BASHNATCH File Stealers: After establishing persistence, the attackers deploy file stealers. PSNATCH is a PowerShell-based script, while BASHNATCH is its Linux/macOS equivalent. Both are configured to search for and exfiltrate specific file types (.docx, .pptx, .xlsx, .pdf, .jpg, .db) that have been modified in the last three months. Stolen files are uploaded to a C2 server, reportedly hosted on Backblaze B2 cloud storage.

Impact Assessment

The primary impact of Operation RapidRust is cyber espionage. The theft of sensitive government and military documents from India and Afghanistan can have significant geopolitical and national security implications. The use of RUSTYMOVE poses a severe risk of cross-domain compromise, potentially bridging the gap between internet-connected and isolated, high-security networks. The continuous evolution of APT36's TTPs indicates a dedicated and well-resourced adversary focused on long-term intelligence gathering objectives.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect this activity:

Detection & Response

• Detection:
  • Network: Monitor and analyze outbound traffic to api.github.com and Backblaze (*.backblazeb2.com). Use D3FEND Outbound Traffic Filtering (D3-OTF) to alert on or block traffic to known malicious domains. SSL/TLS inspection is necessary to gain visibility into the content of the API calls.
  • Endpoint: Deploy EDR solutions to detect the execution of PowerShell-based file stealers and the creation of malicious LNK files on removable media. Use YARA rules to scan for the RUSTYSHADE and RUSTYMOVE binaries.
• Response:
  • Isolate compromised hosts from the network.
  • Block the identified C2 domains at the network perimeter.
  • Conduct a forensic analysis of affected systems to determine the extent of data exfiltration.
  • Scan all removable media used within the organization.

Mitigation

1. Restrict Removable Media: Implement strict policies controlling the use of USB drives and other removable media. Use endpoint protection solutions to block or scan all such devices. (M1034 - Limit Hardware Installation).
2. Network Egress Filtering: Restrict outbound connections to services like GitHub and Backblaze from general-purpose workstations and servers. Allow such connections only from specific developer systems where there is a business need. (M1037 - Filter Network Traffic).
3. PowerShell Hardening: Constrain PowerShell language mode and enable script block logging to detect and prevent the execution of malicious scripts like PSNATCH. (M1028 - Operating System Configuration).
4. User Training: Educate users to be suspicious of emails and websites from unfamiliar sources, especially those impersonating known brands. (M1017 - User Training).