Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

1. Executive summary

Zscaler ThreatLabz attributes a new campaign, Operation RapidRust, to Transparent Tribe (APT36), targeting government and defence entities in India and Afghanistan. The campaign introduces four previously undocumented tools: the Rust backdoor RUSTYSHADE, the USB propagation tool RUSTYMOVE, and the file stealers PSNATCH (Windows) and BASHNATCH (Linux). RUSTYSHADE uses attacker-controlled private GitHub repositories for encrypted C2, and the actor registers typosquatted domains impersonating Indian news outlets to host malicious PowerShell payloads. Attribution rests on a single vendor report and the alias "Earth Karkaddan" has no MITRE ATT&CK profile, so treat the attribution as unconfirmed. Direct exposure for EMEA financial services is low: no financial-sector victims are named. The relevant risk is indirect, via staff or third parties with connectivity to the targeted regions, and via the abuse of GitHub as C2 infrastructure, which can evade domain-based controls.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The campaign targets government and defence entities in India and Afghanistan; no financial-sector victim, incident, or third-party relationship is identified in the source material. Clients with operational or outsourcing links to the affected regions should assess exposure under their existing ICT third-party risk processes, but the source gives no fact that triggers a named article.

3. Technical analysis & attack chain

Confirmed steps, as described by Zscaler ThreatLabz:

1. The actor registers typosquatted domains impersonating Indian news organisations: theprints[.]org (mimicking theprint[.]in) and indiatodays[.]org (mimicking indiatoday[.]in). These host malicious PowerShell scripts and payloads.
2. A victim is compromised; the source does not specify the initial access vector, so the delivery mechanism (phishing lure, link, or document) is unconfirmed.
3. RUSTYSHADE, a Rust-based backdoor, is deployed. It communicates over the GitHub REST API with attacker-controlled private GitHub repositories, parsing and writing files for bidirectional encrypted C2.
4. Post-compromise, the actor performs system, user, and network reconnaissance, then deploys next-stage payloads.
5. The actor fetches a file stealer from an attacker-controlled GitHub gist, in two variants: PSNATCH for Windows and BASHNATCH for Linux.
6. RUSTYMOVE, a 64-bit Windows USB propagation tool written in Rust, monitors for removable media via a PowerShell script and copies two pre-staged malicious files to the root directory of each detected external drive.

RUSTYSHADE's GitHub-based C2 uses a defined file schema. The malware writes and parses the following files in the private repository:

• command.txt, holding encrypted C2 commands
• results.txt, holding encrypted command output
• info.txt, holding system reconnaissance data
• heartbeat.txt, for keepalive beaconing to confirm active infection
• screenshot.png, for an encrypted desktop screenshot
• webcam_photo.jpg, for an encrypted webcam capture
• download.bin, for encrypted exfiltrated file contents

The command set allows RUSTYSHADE to take screenshots, capture a webcam photo, perform file operations, and run commands in the background. Zscaler notes functional overlap with GITSHELLPAD, a Golang implant observed in September 2025 in the Gopher Strike campaign.

PSNATCH is a PowerShell stealer that recursively scans preconfigured directories for Microsoft Office documents, images, archives, media, executables, scripts, and databases modified within the last three months. It exfiltrates files to a private repository named after the infected machine, with collection capped at 1 GB per file and 5 GB per execution. BASHNATCH is a bash script with the same purpose on Linux systems.

RUSTYMOVE copies two files to removable drives: DriverInstaller.zip, which contains RUSTYSHADE, and DocScanner-11-Aug-2026-5-37pm.pdf.LNK, which is suspected to contain a command that executes RUSTYSHADE after extraction. The LNK execution path is suspected, not confirmed.

Confidence caveat: the toolset, the GitHub C2 mechanism, and the typosquatted domains are all single-sourced, from the Zscaler ThreatLabz technical report as relayed by The Hacker News. No second vendor corroborates these specifics. The Acronis TRU report on the PATCHCORD backdoor against Afghan telecom providers and South Asian critical infrastructure is a separate campaign attributed to the same actor and is not part of Operation RapidRust. Attribution to Transparent Tribe (MITRE G0134) is the vendor's assessment; the alias "Earth Karkaddan" has no MITRE ATT&CK profile and should be treated as unconfirmed.

4. Mitigation & containment

P1, within 24 hours:

• Block the domains theprints[.]org and indiatodays[.]org at DNS resolution and on web proxies, and search historical DNS and proxy logs for any resolution or requests to them.
• Search egress logs for GitHub API traffic (api.github[.]com) from endpoints that have no business need for repository access, prioritising any that also show reconnaissance tooling or PowerShell activity. RUSTYSHADE's C2 is indistinguishable from legitimate GitHub use at the domain level, so volume, timing, and host context carry the detection weight.
• Search endpoint telemetry for the artefact filenames: DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK, and any file named command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, or download.bin written by a process with GitHub API network connections.

P2, within 72 hours:

• Restrict removable-media write access on endpoints where it is not required, which breaks RUSTYMOVE's propagation path. Where write access is required, configure EDR to alert on any process writing executable or archive files to the root directory of removable drives.
• Review and restrict outbound access to the GitHub REST API from server estates and service accounts. Allow it from developer endpoints and CI systems under existing policy, and alert on anomalous repository access patterns.
• Hunt for PSNATCH behaviour: PowerShell processes performing recursive directory enumeration filtered on file age (last three months) and file type, followed by large uploads. The 1 GB per file and 5 GB per execution caps give a concrete threshold for data-loss alerting.

P3, within 7 days:

• Brief staff with travel or correspondence links to Indian and Afghan government and defence sectors on the typosquatted news domains, and add both domains to mail and web gateways as impersonation indicators.
• Review DLP rules for uploads to code-hosting platforms. PSNATCH and RUSTYSHADE both exfiltrate through GitHub, so DLP coverage must inspect HTTPS uploads to github[.]com and its API endpoints, not only consumer file-sharing services.

No vendor fix applies; this is a threat-actor campaign, not a product vulnerability.

5. Indicators of compromise

domain  theprints[.]org
domain  indiatodays[.]org
filename  DriverInstaller.zip
filename  DocScanner-11-Aug-2026-5-37pm.pdf.LNK
filename  command.txt
filename  results.txt
filename  info.txt
filename  heartbeat.txt
filename  screenshot.png
filename  webcam_photo.jpg
filename  download.bin

No file hashes, IP addresses, or C2 repository names are present in the source material. The full IOC set is single-sourced from the Zscaler ThreatLabz report; verify against the original technical report before enforcement at scale.

6. Detection

The sources provide distinctive filenames used by the toolset but no file content, hashes, or command-line strings. The filenames below are artefacts of the threat itself: RUSTYSHADE's C2 file schema and RUSTYMOVE's dropped files. Generic names such as command.txt and results.txt appear in legitimate software, so the rule pairs them with the more distinctive artefacts and is intended for use alongside the GitHub API network context described in §4.

rule RUSTYSHADE_GitHub_C2_Fileschema {
    meta:
        author = "Adverse Trace"
        date = "2026-09-18"
        reference = "https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html"
        description = "Detects RUSTYSHADE Rust backdoor by its GitHub C2 file schema strings and RUSTYMOVE dropped filenames"
    strings:
        $c2_1 = "command.txt" ascii
        $c2_2 = "results.txt" ascii
        $c2_3 = "info.txt" ascii
        $c2_4 = "heartbeat.txt" ascii
        $c2_5 = "screenshot.png" ascii
        $c2_6 = "webcam_photo.jpg" ascii
        $c2_7 = "download.bin" ascii
        $mv_1 = "DriverInstaller.zip" ascii
        $mv_2 = "DocScanner-11-Aug-2026-5-37pm.pdf.LNK" ascii
    condition:
        uint16(0) == 0x5A4D and 5 of ($c2_*) or 1 of ($mv_*)
}

A Sigma rule for the RUSTYMOVE propagation behaviour, based on the observed file writes to removable drives:

title: RUSTYMOVE USB propagation file drop
id: 7c1f2a94-3e58-4d21-9b6a-8f0d5c2e41aa
status: experimental
description: Detects RUSTYMOVE writing pre-staged malicious files to the root directory of removable media, per Zscaler ThreatLabz Operation RapidRust reporting.
references:

    - https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html
author: Adverse Trace
date: 2026-09-18
logsource:
    product: windows
    service: sysmon
detection:
    selection_event:
        EventID: 11
    selection_target:

        - TargetFilename|endswith: '\DriverInstaller.zip'
        - TargetFilename|endswith: 'DocScanner-11-Aug-2026-5-37pm.pdf.LNK'
    filter_remdrive:
        TargetFilename|startswith: 'A:\'
    filter_remdrive2:
        TargetFilename|startswith: 'B:\'
    condition: selection_event and selection_target
falsepositives:

    - Legitimate software distribution via USB drives using identically named archives
level: high

The sysmon EventID 11 file-creation events for these writes are the highest-value log source; no registry or scheduled-task indicators are present in the source material.

Threat actor context

Transparent Tribe · G0134 · aka COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.

No MITRE ATT&CK profile for: Earth Karkaddan.

7. Sources

• The Hacker News, "Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2", https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html, 2026-09-18
• Zscaler ThreatLabz technical report on Operation RapidRust, referenced by the above article; original URL not provided in the source material

8. Adverse Trace position

We assess the direct threat to EMEA financial services as low: the named victims are government and defence entities in India and Afghanistan, and no financial-sector compromise is reported. The campaign matters to clients for two reasons. First, it demonstrates a working abuse of private GitHub repositories as encrypted C2 and exfiltration channels, which defeats domain blocklists and requires API-level egress visibility and DLP coverage on code-hosting platforms. Second, the USB propagation tool gives the actor a path into air-gapped or restricted networks via removable media, which is relevant to any client operating segregated environments. The entire toolset and IOC set is single-sourced from Zscaler ThreatLabz, and the "Earth Karkaddan" alias has no MITRE ATT&CK profile, so we treat the attribution as unconfirmed pending a second vendor's corroboration. We will track the Zscaler technical report for the full IOC set, including hashes and C2 repository names absent from this coverage, and will update this advisory if financial-sector victims or European infrastructure appear in follow-on reporting.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.