Transparent Tribe Targets India and Afghanistan in Operation RapidRust With New Rust-Based Malware
The Pakistan-aligned threat group known as Transparent Tribe, also tracked as APT36 and Earth Karkaddan, has been linked to a new series of cyber attacks targeting government and defense organizations in India and Afghanistan.
According to security researchers at Zscaler ThreatLabz, the campaign involves several previously undocumented malware and utility families, including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.
The activity has been named Operation RapidRust.
Researchers said the campaign demonstrates that Transparent Tribe continues to maintain a high operational tempo while updating its tactics, techniques and procedures to target government and defense organizations across South Asia.
New Malware Families Identified
The newly identified tools perform different roles during the attacks.
RUSTYSHADE is a Rust-based backdoor designed to provide attackers with remote access and command execution capabilities.
RUSTYMOVE is a Windows-based USB propagation utility designed to spread malicious files through removable storage devices.
PSNATCH is a PowerShell-based file stealer targeting Windows systems.
BASHNATCH is a Bash-based file collection tool designed for Linux environments.
Together, the tools provide Transparent Tribe with capabilities for persistence, lateral movement, surveillance and data theft.
RUSTYSHADE Uses Private GitHub Repositories for C2
One of the notable aspects of Operation RapidRust is the use of private GitHub repositories as a command and control mechanism.
RUSTYSHADE uses the GitHub REST API to communicate with attacker-controlled private repositories. The malware encrypts information exchanged through the repository, allowing the threat actor to use GitHub as an intermediary communication channel.
Researchers identified several files used by the malware for different purposes:
- command.txt stores encrypted commands from the attacker.
- results.txt stores encrypted command output.
- info.txt contains system reconnaissance information.
- heartbeat.txt is used for keepalive communications.
- screenshot.png stores encrypted desktop screenshots.
- webcam_photo.jpg stores encrypted webcam captures.
- download.bin contains encrypted exfiltrated files.
The malware can execute commands in the background and perform several surveillance and file management operations.
These include taking screenshots, capturing webcam images, performing file operations and executing commands on compromised systems.
Researchers also observed similarities between RUSTYSHADE and GITSHELLPAD, a Golang-based implant previously associated with Transparent Tribe activity.
PSNATCH Steals Files From Windows Systems
Following initial compromise, the attackers can deploy a file stealing component called PSNATCH.
PSNATCH is written as a PowerShell script and recursively searches predefined directories on Windows systems.
The malware searches for multiple categories of files, including:
- Microsoft Office documents
- Images
- Archives
- Media files
- Executable files
- Scripts
- Database files
The stealer focuses on files modified within the previous three months.
Collected files are uploaded to a private GitHub repository associated with the infected system.
Researchers said PSNATCH limits collection to approximately 1 GB per individual file and 5 GB per execution.
BASHNATCH Targets Linux Systems
Transparent Tribe also uses a Linux-focused variant called BASHNATCH.
The tool follows an approach similar to PSNATCH but uses Bash scripting to search and collect files from Linux systems.
This gives the threat actor a cross-platform data theft capability covering both Windows and Linux environments.
RUSTYMOVE Spreads Malware Through USB Drives
Another significant component of the campaign is RUSTYMOVE, a lightweight 64-bit Windows utility written in Rust.
The tool continuously monitors the system for newly connected removable storage devices.
When an external drive is detected, RUSTYMOVE copies two pre-staged malicious files to the root directory of the device.
The files include:
DriverInstaller.zip
The archive contains the RUSTYSHADE backdoor.
DocScanner-11-Aug-2026-5-37pm.pdf.LNK
The file is a Windows shortcut that researchers suspect is designed to trigger execution of RUSTYSHADE after the archive or associated content is opened.
The USB propagation mechanism can allow the malware to move between systems when infected removable drives are connected to additional computers.
Typosquatted Domains Mimic Indian News Organizations
The campaign also makes use of domains designed to resemble legitimate Indian news organizations.
Researchers identified:
- theprints[.]org, designed to resemble The Print
- indiatodays[.]org, designed to resemble India Today
The infrastructure was used to host malicious PowerShell scripts and payloads.
Using domains that resemble well-known organizations can make malicious links appear more legitimate and potentially increase the chances of successful social engineering.
Attackers Use GitHub for Command and Control
Private GitHub repositories appear to play an important role in the operation.
Instead of relying exclusively on dedicated command and control infrastructure, the attackers can use legitimate cloud services to exchange encrypted commands and stolen information.
This approach can make network monitoring more difficult because connections to GitHub can blend with legitimate developer and business traffic.
The technique also provides the attacker with an established internet infrastructure rather than requiring a dedicated server for every operation.
Reconnaissance and Post-Compromise Activity
After gaining access to a target environment, Transparent Tribe operators conduct system, user and network reconnaissance.
The attackers then deploy additional payloads depending on the target and objectives.
Researchers observed significant activity between August 20 and September 1, 2026.
The command and control activity also followed a specific schedule.
Commands were issued between approximately 4 a.m. and 11 a.m. UTC and were observed only on weekdays.
This operational pattern may help defenders identify suspicious activity associated with the campaign when combined with other indicators.
Transparent Tribe Continues Regional Operations
The latest campaign follows previous Transparent Tribe activity targeting organizations across South Asia.
In August 2026, researchers linked the group to another campaign targeting Afghan telecommunications providers and critical infrastructure organizations in the region.
That operation involved a backdoor known as PATCHCORD.
The continued use of new malware families and updated infrastructure indicates that the threat actor remains active and continues modifying its operational techniques.
Security Implications
Operation RapidRust highlights several techniques that security teams should monitor closely.
Organizations should pay particular attention to suspicious PowerShell and Bash activity, unexpected GitHub API connections, unauthorized access to removable storage, newly created scheduled or persistent processes, and domains that closely resemble legitimate organizations.
Security teams should also monitor for unexpected repositories or GitHub-based communication from systems that normally have no requirement to interact with GitHub APIs.
Endpoint monitoring should be used to identify suspicious execution of files from removable media and unusual creation or execution of Windows shortcut files.
Organizations operating in government, defense and critical infrastructure sectors should review their environments for indicators associated with RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH.
Conclusion
Operation RapidRust demonstrates the continued evolution of Transparent Tribe's tooling and operational techniques.
The campaign combines Rust-based malware, PowerShell and Bash scripts, USB propagation, private GitHub repositories and typosquatted domains to target government and defense organizations in India and Afghanistan.
The use of legitimate online services such as GitHub for encrypted command and control further demonstrates how threat actors can attempt to blend malicious communications with normal internet traffic.
Security teams should focus on detecting unusual endpoint behavior, suspicious use of scripting engines, unauthorized removable-media activity and unexpected communications with external GitHub infrastructure.
According to the supplied research, Transparent Tribe continues to target government and defense organizations while expanding and updating its malware toolkit.
