Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repos for C2

A New Toolset From a Familiar Actor

Transparent Tribe — the Pakistan-aligned threat group also tracked as APT36 and Earth Karkaddan — has been linked to a fresh campaign, dubbed Operation RapidRust, deploying a new suite of malware against government and defense organizations in India and Afghanistan. The centerpiece is RUSTYSHADE, a previously undocumented backdoor written in Rust that uses private GitHub repositories as its command-and-control channel.

Researchers at Zscaler ThreatLabz, led by senior manager of APT Research Sudeep Singh, attributed the campaign and published technical details on September 18, 2026.

How RUSTYSHADE Talks to Its Operators

Rather than beaconing to a traditional C2 server, RUSTYSHADE communicates by reading and writing files inside a private GitHub repository using the GitHub REST API — a technique that blends malicious traffic into ordinary HTTPS calls to a trusted, widely allow-listed domain. The backdoor uses a set of named files for bidirectional communication:

Because the traffic is indistinguishable from legitimate GitHub API usage at the network level, this C2 method is difficult for perimeter tools to flag without specific behavioral detection.

The Full Toolset

Operation RapidRust deploys four distinct tools, each with a specialized role:

Delivery and Targeting

The campaign relies on typosquatted domains — including theprints[.]org and indiatodays[.]org — that host malicious PowerShell scripts posing as legitimate downloads. Once a foothold is established, RUSTYMOVE spreads the infection further via removable USB drives, extending reach into air-gapped or loosely connected government and defense networks.

Post-compromise, the group's file-stealing tools specifically target Office documents, images, archives, and databases modified within the past three months — a targeting window suggesting the operators are after current, actively used material rather than bulk historical data.

Why This Matters

Abusing developer platforms like GitHub for C2 is a growing pattern among state-aligned actors, since it lets malicious traffic hide behind infrastructure that security teams are reluctant to block outright. Combined with USB propagation, RUSTYSHADE gives Transparent Tribe a way to reach networks that are partially isolated from the internet — a common configuration in defense environments.

Organizations in the government and defense sectors, particularly in South Asia, should:

• Monitor for unexpected GitHub API traffic from endpoint and server hosts
• Restrict or monitor USB device usage on sensitive networks
• Block or closely inspect traffic to newly registered, typosquatted domains
• Review PowerShell execution logs for unrecognized scripts tied to document- or media-themed lures

Sources

• The Hacker News — Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2