As reported by The Hacker News, Zscaler ThreatLabz has unveiled Operation RapidRust, a campaign by the Pakistan-aligned APT36 (Transparent Tribe) deploying four previously undocumented tools β€” RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH β€” against government and defense organizations in India and Afghanistan. What deserves particular attention from defenders is not merely the tooling refresh, but the deliberate operational engineering choices that make this campaign emblematic of where adversary tradecraft is heading.

Threat Intelligence: As reported by The Hacker News, Zscaler ThreatLabz has unveiled Operation RapidRust, a campaign by the Pakistan-aligned APT36 (Transparent Tribe) deploying four previously undocumented tools β€” RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH β€” against government and defense organizations in India and Afghanistan.

The GitHub C2 Pattern Is the Real Story

RUSTYSHADE's use of private GitHub repositories for encrypted bidirectional C2 is a continuation of a pattern Shield53 has been tracking across multiple threat actors. By writing structured files β€” command.txt, results.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg β€” through the GitHub REST API, the operators generate traffic that is functionally indistinguishable from legitimate developer activity at the network layer.

This is the core defensive problem: when C2 lives inside a platform your organization already permits for software development, perimeter-based detection loses its anchor.

The technique mirrors GITSHELLPAD, a Golang implant linked to September 2025's Gopher Strike campaign, suggesting either shared developers, shared infrastructure, or an active convergence in South Asian APT tradecraft toward GitHub-abusing implants. The earlier PATCHCORD backdoor attributed by Acronis TRU reinforces that APT36 is iterating rapidly across multiple toolchains.

Why Rust Matters Operationally

The shift to Rust is not aesthetic. Rust binaries present meaningful reverse-engineering friction β€” fewer mature decompilation pipelines, complex type recovery, and smaller analyst familiarity compared to C++ or .NET payloads. For APT36, which has historically relied on simpler .NET and Python tooling, this represents a deliberate investment in analyst fatigue andε»Άι•Ώd detection windows.

The dual-platform file stealers (PSNATCH for Windows, BASHNATCH for Linux) also signal broadening target infrastructure β€” likely reflecting that defense and telecom networks now run mixed OS environments rather than Windows-only estates.

Who Is Most Exposed

Why Rust Matters Operationally
South Asian government and defense ministries β€” primary targeting vector via typosquatted news domains (theprints[.]org, indiatodays[.]org)
Telecom and critical infrastructure operators in Afghanistan and neighboring states
Any organization permitting unrestricted github.com egress β€” the C2 channel is not geographically bounded
Defense supply chains with developer-to-developer GitHub collaboration as a business norm

Shield53 Recommendations

Immediate Actions

  • Hunt for GitHub C2 artifacts: Search endpoint telemetry for processes writing files named command.txt, results.txt, heartbeat.txt, info.txt in sequence within GitHub repository clone paths or temp directories.
  • Inspect GitHub API traffic: Monitor for api.github.com requests originating from non-developer workstations, especially those with PUT/PATCH methods to repository contents endpoints β€” legitimate developer activity rarely originates from defense ministry endpoints.
  • Block and sinkhole typosquatted domains: Add theprints[.]org and indiatodays[.]org to DNS blocklists immediately; audit for any historical resolution in your environment.
  • Deploy EDR YARA rules for Rust binaries making GitHub API calls from non-standard paths β€” flag unsigned Rust executables issuing HTTPS requests to api.github.com/repos/.

Strategic Hardening

  • Implement GitHub egress allowlisting β€” restrict github.com and api.github.com access to known developer IP ranges and CI/CD pipelines only; force all other traffic through inspected proxy paths.
  • Adopt behavioral C2 detection β€” move beyond domain/URL reputation toward beaconing pattern analysis: periodic, low-volume HTTPS to developer platforms from non-developer hosts is a high-signal indicator.
  • Assume trusted-platform abuse in your threat model β€” GitHub, Notion, Google Drive, and similar services are now default C2 infrastructure for mid-tier and advanced actors alike.
  • Engage in Purple Team validation of GitHub-based C2 detection rules using controlled simulations β€” confirm your SIEM can distinguish developer push activity from implant beaconing.

The broader implication is clear: APT36 is not an elite-tier adversary, but their operational adaptability β€” moving to Rust, abusing GitHub, combining typosquatted infrastructure with encrypted API-based C2 β€” reflects a democratization of techniques that were once the province of top-tier Russian and Chinese groups. Defenders who continue treating GitHub as inherently trusted traffic will find their detection blind spot increasingly exploited.