Operation RapidRust shows APT36 evolving beyond simple phishing lures

Operation RapidRust shows APT36 evolving beyond simple phishing lures

APT36, also tracked as Transparent Tribe, has a new campaign worth more than a passing malware note. Zscaler ThreatLabz says the Pakistan-nexus group used a fresh toolset in August 2026 against government and defense entities in India and Afghanistan, including a Rust backdoor, removable-media propagation, and Windows and Linux file stealers.

The campaign, tracked as Operation RapidRust, belongs in the threat intelligence queue because the defensive question is not only "what file should we block?" It is "which trusted services, removable devices, and post-compromise behaviors should we monitor when a regional espionage actor changes its tooling?"

What changed in Operation RapidRust

Zscaler identified four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The most important is RUSTYSHADE, a 64-bit Windows backdoor written in Rust that uses attacker-controlled private GitHub repositories for encrypted command and control.

That design matters. GitHub traffic can blend into normal developer and business activity, and private repositories can make infrastructure review harder for teams that only look for suspicious domains or commodity hosting patterns. According to Zscaler, the backdoor uses the GitHub REST API and synchronizes tasks and output through repository files such as command.txt, results.txt, info.txt, and heartbeat.txt.

The toolset also includes:

• RUSTYMOVE, a Windows USB propagation utility that copies pre-staged malicious files to removable media.
• PSNATCH, a PowerShell file stealer for Windows environments.
• BASHNATCH, a similar Bash-based stealer for Linux systems.
• Typosquatted domains impersonating Indian media organizations to stage scripts and payloads.

That mix turns the campaign into a broader intrusion story rather than a single malware family. It combines initial access, persistence, data collection, lateral movement support, and exfiltration paths across multiple operating environments.

Why defenders should care

APT36 has long relied on social engineering and regionally tailored lures, but Operation RapidRust shows a more mature post-compromise workflow. ThreatLabz observed system, user, and network reconnaissance, next-stage payload deployment, and activity clustered between August 20 and September 1, 2026.

The timing is useful for hunters. Zscaler says observed command activity happened on weekdays and only between 4:00 a.m. and 11:00 a.m. UTC. Time-of-day alone is never a detection, but it can help analysts prioritize suspicious GitHub API activity, PowerShell download behavior, unusual file staging, and removable-media writes during a triage window.

The GitHub C2 pattern is especially important. Many organizations allow GitHub broadly, and many endpoint and proxy rules treat GitHub as a trusted collaboration platform. Attackers abusing legitimate developer infrastructure can force defenders to move from domain-based blocking toward behavior, identity, token, and repository-access monitoring.

What to hunt for now

Security teams with exposure to the targeted regions, sectors, or related diplomatic and defense work should start with evidence collection before rushing into broad blocking decisions.

Prioritize:

• Unusual GitHub REST API traffic from endpoints that do not normally interact with GitHub.
• PowerShell commands downloading archives or scripts from cloud storage and recently registered domains.
• Newly created or modified files matching the campaign's tasking pattern, especially command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, and download.bin.
• Removable-media writes that copy archives and shortcut files to the root of USB drives.
• File collection scripts scanning recent documents, archives, images, scripts, and databases.
• Endpoint activity that combines reconnaissance commands with GitHub API access and compressed file staging.

For identity teams, this campaign is also a reminder to review where personal access tokens, developer tokens, and service tokens appear on endpoints. Even when a campaign uses attacker-controlled accounts, the same telemetry can reveal whether internal GitHub tokens are being accessed, copied, or abused after compromise.

Detection should focus on behavior, not just indicators

Indicators from the Zscaler report are useful, but they will age quickly. The durable lesson is that APT36 is adopting legitimate cloud and developer workflows to make espionage tooling look less alien inside enterprise networks.

Instead of treating GitHub C2 as an isolated trick, defenders should model it as a pattern:

• legitimate SaaS platform used as command transport
• encrypted tasking and output stored as files
• cloud storage used for staging
• removable media used for propagation
• cross-platform scripts used for file theft

That pattern can be translated into detections across endpoint, proxy, identity, and data-loss tooling. The best signal will come from combinations: a non-developer workstation talking to GitHub APIs, shortly after PowerShell fetched an archive, followed by local reconnaissance and file collection.

Practical response steps

Organizations that may be in scope should:

1. Review Zscaler's indicators and map them into EDR, proxy, and DNS controls.
2. Hunt for GitHub API activity from non-developer endpoints and high-risk users.
3. Inspect removable-media events on sensitive workstations.
4. Look for PowerShell and Bash scripts that enumerate documents, archives, media, executables, and databases.
5. Review controls around GitHub personal access tokens and alert on unexpected token use.
6. Preserve logs before containment if espionage targeting is plausible.

Operation RapidRust is not just another backdoor write-up. It is a reminder that espionage actors are learning from normal enterprise workflows. The more ordinary the transport looks, the more defenders need to connect endpoint behavior, SaaS access, and data movement into one investigation.

References

1. Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
2. Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2