A New Toolset From a Familiar Actor
Transparent Tribe — the Pakistan-aligned threat group also tracked as APT36 and Earth Karkaddan — has been linked to a fresh campaign, dubbed Operation RapidRust, deploying a new suite of malware against government and defense organizations in India and Afghanistan. The centerpiece is RUSTYSHADE, a previously undocumented backdoor written in Rust that uses private GitHub repositories as its command-and-control channel.
Researchers at Zscaler ThreatLabz, led by senior manager of APT Research Sudeep Singh, attributed the campaign and published technical details on September 18, 2026.
How RUSTYSHADE Talks to Its Operators
Rather than beaconing to a traditional C2 server, RUSTYSHADE communicates by reading and writing files inside a private GitHub repository using the GitHub REST API — a technique that blends malicious traffic into ordinary HTTPS calls to a trusted, widely allow-listed domain. The backdoor uses a set of named files for bidirectional communication:
| File | Purpose |
|---|---|
command.txt | Operator-issued commands |
results.txt | Command execution results |
info.txt | Host reconnaissance data |
heartbeat.txt | Beacon / liveness check |
screenshot.png | Captured screenshots |
webcam_photo.jpg | Webcam captures |
download.bin | Staged payloads for download |
Because the traffic is indistinguishable from legitimate GitHub API usage at the network level, this C2 method is difficult for perimeter tools to flag without specific behavioral detection.
The Full Toolset
Operation RapidRust deploys four distinct tools, each with a specialized role:
| Tool | Function |
|---|---|
| RUSTYSHADE | Rust-based backdoor; C2 over private GitHub repos |
| RUSTYMOVE | 64-bit Windows tool for USB-based propagation |
| PSNATCH | PowerShell-based file stealer (Windows) |
| BASHNATCH | Bash equivalent of PSNATCH (Linux) |
Delivery and Targeting
The campaign relies on typosquatted domains — including theprints[.]org and indiatodays[.]org — that host malicious PowerShell scripts posing as legitimate downloads. Once a foothold is established, RUSTYMOVE spreads the infection further via removable USB drives, extending reach into air-gapped or loosely connected government and defense networks.
Post-compromise, the group's file-stealing tools specifically target Office documents, images, archives, and databases modified within the past three months — a targeting window suggesting the operators are after current, actively used material rather than bulk historical data.
Why This Matters
Abusing developer platforms like GitHub for C2 is a growing pattern among state-aligned actors, since it lets malicious traffic hide behind infrastructure that security teams are reluctant to block outright. Combined with USB propagation, RUSTYSHADE gives Transparent Tribe a way to reach networks that are partially isolated from the internet — a common configuration in defense environments.
Organizations in the government and defense sectors, particularly in South Asia, should:
- Monitor for unexpected GitHub API traffic from endpoint and server hosts
- Restrict or monitor USB device usage on sensitive networks
- Block or closely inspect traffic to newly registered, typosquatted domains
- Review PowerShell execution logs for unrecognized scripts tied to document- or media-themed lures