The **Transparent Tribe** threat group, also known as **APT36** and **Earth Karkaddan**, has been linked to a new wave of cyber attacks. These attacks are specifically aimed at government and defense entities within India and Afghanistan. ### Operation RapidRust Uncovered According to **Zscaler ThreatLabz**, the recent activity, dubbed **Operation RapidRust**, involves the deployment of several novel tools. These include **RUSTYSHADE**, **RUSTYMOVE**, **PSNATCH**, and **BASHNATCH**. **Sudeep Singh**, Senior Manager of APT Research at **Zscaler ThreatLabz**, noted in a recent technical report: "APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan." This discovery follows a campaign just over a month prior, where **Acronis Threat Research Unit (TRU)** connected **Transparent Tribe** to attacks on Afghan telecom providers and critical infrastructure in South Asia, utilizing a backdoor named **PATCHCORD**. ### Evolving TTPs: GitHub C2 and Typosquatting A key characteristic of **Operation RapidRust** is the threat actor's sophisticated use of private **GitHub** repositories for command-and-control (C2) operations. Furthermore, they have registered typosquatted domains, such as `theprints[.]org` and `indiatodays[.]org`, to impersonate reputable Indian news organizations like **The Print** and **India Today**. These domains are used to host malicious **PowerShell** scripts and payloads. ### New Malware Families: Backdoor, Lateral Movement, and Stealers The four newly identified malware families serve distinct purposes: * One functions as a backdoor. * Another is designed for lateral movement. * The remaining two are file-stealing programs, adapted for both **Windows** and **Linux** systems. #### RUSTYSHADE: The Rust-Based Backdoor **RUSTYSHADE**, developed in **Rust**, operates as a backdoor, leveraging attacker-controlled private **GitHub** repositories for encrypted C2 communications. It exhibits functional similarities to **GITSHELLPAD**, a **Golang** implant previously observed in the **Gopher Strike** campaign in September 2025. This malware communicates by parsing and writing specific files within its private **GitHub** repository via the **GitHub REST API**. These files include: * `command.txt`: Stores encrypted C2 commands. * `results.txt`: Holds encrypted command output. * `info.txt`: Contains system reconnaissance data. * `heartbeat.txt`: Used for keepalive beaconing. * `screenshot.png`: Stores encrypted desktop screenshots. * `webcam_photo.jpg`: Stores encrypted webcam captures. * `download.bin`: Contains encrypted exfiltrated file contents. **RUSTYSHADE** is capable of taking screenshots, capturing webcam photos, performing file operations, and executing commands in the background. #### PSNATCH and BASHNATCH: The File Stealers During post-compromise activities, **APT36** operators have deployed file stealers from an attacker-controlled **GitHub** gist. These come in two variants: * **PSNATCH**: A **PowerShell** stealer for **Windows** systems. It recursively scans predefined directories for **Microsoft Office** documents, images, archives, media, executables, scripts, and databases modified within the last three months. Exfiltrated data is sent to a private repository named after the infected machine, with collection limits of 1 GB per file and 5 GB per execution. * **BASHNATCH**: A **bash** script mirroring **PSNATCH**'s functionality, but targeting **Linux** environments. #### RUSTYMOVE: The USB Propagation Tool Perhaps the most distinctive tool is **RUSTYMOVE**, a lightweight 64-bit **Windows** USB propagation utility, also written in **Rust**. Its primary function is to continuously monitor for external removable media using a **PowerShell** script. Upon detection, it copies two pre-staged malicious files to the root directory of the external drive: * `DriverInstaller.zip`: Contains **RUSTYSHADE**. * `DocScanner-11-Aug-2026-5-37pm.pdf.LNK`: Suspected to contain a command to execute **RUSTYSHADE** after extraction. ### Post-Compromise Activities and Operational Timings **APT36**'s post-compromise actions include system, user, and network reconnaissance, followed by the deployment of subsequent payloads. A significant portion of these activities was observed between August 20 and September 1, 2026. Interestingly, C2 commands were issued only on weekdays, specifically between 4 a.m. and 11 a.m. UTC. "This campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs," **Singh** concluded.