Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets

Key facts for Operation RapidRust

Detection coverage for Operation RapidRust

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2545 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain

Detects Operation RapidRust's command-and-control and exfiltration abuse of GitHub's legitimate REST/Contents API — RUSTYSHADE's AES-256-GCM 'HCENC1:' encoded command/result sync via command.txt/results.txt/info.txt/heartbeat.txt/screenshot.png/webcam_photo.jpg/download.bin in attacker-controlled private repos, and PSNATCH/BASHNATCH's file exfiltration under the custom 'SmartUploader' User-Agent — together with the post-compromise host/network reconnaissance (ipconfig, whoami, tasklist, arp -a, subnet ping sweeps, nbtstat, net view, IP-geolocation lookups) and null/authenticated SMB lateral movement (net use \\[IP]\IPC$) observed between 2026-08-20 and 2026-09-01 during Pakistan-business-hours (04:00-11:00 UTC) operator windows. Community OSINT (TL_OSINT_Scan) corroborates the RUSTYSHADE Backblaze staging URL with a sighting from before this disclosure, and tags the cluster 'mythic' (Mythic C2 framework family association) — factor this into hunting for a Mythic-based fallback C2 alongside the GitHub-API channel.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1573, T1567, T1102, T1021, T1018, T1135, T1082, T1113, T1125, T1005
• Data sources: proxy, dns, sysmon, windows_security, netflow
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=network
(http_user_agent="*SmartUploader*")
OR (dest="api.github.com" AND (uri_path="*/contents/*" OR http_method="PUT"))
OR (payload="HCENC1:*")
OR (process="cmd.exe" AND CommandLine IN ("*ipconfig*","*whoami*","*tasklist*","*arp -a*","*nbtstat*","*net view*"))
OR (CommandLine="*net use*" AND CommandLine="*IPC$*")
OR (dest_ip IN ("ip-api.com","ipinfo.io","ipapi.co"))
| eval stage=case(
    match(http_user_agent, "SmartUploader"), "psnatch_bashnatch_exfil",
    match(payload, "HCENC1"), "rustyshade_c2",
    dest="api.github.com", "github_api_c2_exfil",
    match(CommandLine, "IPC\$"), "smb_lateral_movement",
    true(), "host_network_recon")
| table _time, ComputerName, User, src_ip, dest, http_user_agent, CommandLine, stage
| sort -_time

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteUrl has "api.github.com" and (RemoteUrl has "/contents/" or InitiatingProcessCommandLine has "SmartUploader"))
    or RemoteUrl has_any ("ip-api.com", "ipinfo.io", "ipapi.co")
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any ("ipconfig","whoami","tasklist","arp -a","nbtstat","net view")
        or (ProcessCommandLine has "net use" and ProcessCommandLine has "IPC$")
)
| project Timestamp, DeviceName, AccountName, RemoteUrl, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Sigma

title: APT36 RapidRust GitHub-API C2 Channel and SmartUploader Exfiltration
id: 4f2b8a15-9d6c-4e73-a108-5b1e6c9d0f42
status: experimental
description: Detects RUSTYSHADE's GitHub REST API C2 beaconing (HCENC1 AES-256-GCM payload format, repo file sync) and PSNATCH/BASHNATCH exfiltration via the GitHub Contents API using the custom SmartUploader User-Agent, part of Operation RapidRust.
references:
    - https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.command-and-control
    - attack.t1573.001
    - attack.t1102
    - attack.exfiltration
    - attack.t1567.002
    - attack.collection
    - attack.t1113
    - attack.t1125
    - attack.t1005
    - attack.group.g0134
    - attack.tool.mythic
logsource:
    category: proxy
    product: windows
detection:
    selection_ua:
        c-useragent|contains: 'SmartUploader'
    selection_github:
        cs-host: 'api.github.com'
        cs-uri-stem|contains: '/contents/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate internal automation/CI tooling that also uses the GitHub Contents API for unrelated repository uploads (User-Agent match on 'SmartUploader' is highly specific and unlikely to collide)
level: critical

Known false positives:

• Legitimate developer/CI workflows using the GitHub Contents API from corporate egress could overlap on the generic api.github.com selector; the SmartUploader User-Agent and HCENC1 payload prefix are the high-fidelity narrowing signals
• IT helpdesk or monitoring tools that legitimately call ip-api.com/ipinfo.io/ipapi.co for geolocation should be baselined and excluded

Tuning notes: Weight alerts higher when the SmartUploader UA or HCENC1: payload prefix is present versus the bare api.github.com/recon selectors, which are lower-fidelity and should feed a correlation search rather than fire standalone; restrict the recon-command and net-use-IPC$ selectors to the disclosed operator window (04:00-11:00 UTC weekdays) to cut analyst noise, and expand IOC coverage as TL_OSINT_Scan / tweetfeed.live surface new community-sighted sibling infrastructure for this cluster.

• 🔒 APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) · unlock with TL Creds
• 🔒 RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence · unlock with TL Creds
• 🔒 RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain · unlock with TL Creds
• 🔒 APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) · unlock with TL Creds
• 🔒 RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence · unlock with TL Creds
• 🔒 RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain · unlock with TL Creds
• 🔒 APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) · unlock with TL Creds
• 🔒 RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence · unlock with TL Creds

Indicators of compromise for Operation RapidRust

As of 2026-09-16, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-2545.

Sample indicators (3 of 27)

• Domain: theprints[.]org
• URL: hxxps://clients-easy[.]s3[.]us-east-005[.]backblazeb2[.]com/Automata-20.zip
• File hash: 52d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration for Operation RapidRust

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Operation RapidRust works

APT36 (Transparent Tribe), a Pakistan-nexus cyber-espionage actor tracked by Zscaler ThreatLabz since at least January 2026, ran Operation RapidRust in August 2026 against government and defense-sector targets in India and Afghanistan. The actor lured victims through typosquatted domains impersonating Indian news outlets (theprints[.]org mimicking theprint.in, indiatodays[.]org mimicking indiatoday.in, and officialinfo[.]org), all registered through NameCheap, and staged PowerShell downloader commands (`powershell wget <url> -o ww.zip`) that pulled ZIP archives from Backblaze B2 cloud storage (f005.backblazeb2.com, clients-easy.s3.us-east-005.backblazeb2.com).

The operation introduced four new tools. RUSTYSHADE is a 64-bit Windows Rust backdoor that abuses attacker-controlled private GitHub repositories as its command-and-control channel via the GitHub REST API, authenticating with hardcoded Personal Access Tokens and deriving a 32-byte AES key from the SHA-256 hash of that PAT to encrypt traffic with AES-256-GCM (message format `HCENC1:[base64(nonce||ciphertext||tag)]`, nonces generated with BCryptGenRandom). It synchronizes commands and results through repository files (command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, download.bin) and supports screenshot capture (ss_up), webcam capture (CAP-photo), directory/drive enumeration (HC_LIST, HC_DRIVES), file exfiltration (HC_DOWNLOAD), and arbitrary command execution (run).

RUSTYMOVE is a companion 64-bit Windows Rust binary purpose-built to bridge air-gapped networks: it continuously enumerates newly attached removable media (USB, SD, MMC, IEEE 1394) by BusType/MediaType, tracks previously infected volumes by UniqueId to avoid re-infection, and copies pre-staged malicious files (DriverInstaller.zip, and the LNK lure DocScanner-11-Aug-2026-5-37pm.pdf.LNK) onto them. Persistence on infected hosts is established via scheduled tasks masquerading as legitimate update services ("StandAloneOneDriveUpdater-2626", "MicrosoftEdgeUpdateTaskUserS-1-5-24-") that trigger at user logon.

PSNATCH (PowerShell) and BASHNATCH (its Bash/Linux counterpart) are file-stealing tools that scan Desktop, Downloads, Documents, and OneDrive folders plus mapped drives D:-H: for documents, images, archives, media, executables, scripts, and databases modified within the last 120 days, then exfiltrate them (capped at 1 GB per file / 5 GB per run) directly into per-machine private GitHub repositories via the GitHub Contents API, using a custom "SmartUploader" user agent and a local JSON tracking file to avoid re-uploading.

Post-compromise activity observed between August 20 and September 1, 2026 (operating 4:00 AM-11:00 AM UTC on weekdays, consistent with Pakistan-based operator hours) included extensive host and network reconnaissance (ipconfig, whoami, tasklist, hostname, arp -a, subnet ping sweeps across 1-254, nbtstat, net view, SMB/RPC port checks on 445/135, and IP-geolocation lookups against ip-api.com/ipinfo.io/ipapi.co), lateral movement via null and authenticated SMB sessions (net use \\[IP]\IPC$), and anti-forensic cleanup through deletion and renaming of staged artifacts (e.g., om.zip renamed to DriverInstaller.zip, followed by deletion of intermediate files). No CVE or software vulnerability underlies this campaign; the operation relies entirely on social-engineering delivery, abuse of legitimate cloud services (GitHub, Backblaze B2) for C2/exfiltration, and physical/removable-media propagation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture

Discovery

T1018 Remote System Discovery; T1082 System Information Discovery; T1135 Network Share Discovery

Lateral Movement

T1021 Remote Services; T1091 Replication Through Removable Media

Defense Evasion

T1036 Masquerading

Persistence

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Initial Access

T1566 Phishing

Exfiltration

T1567 Exfiltration Over Web Service

Command and Control

T1573 Encrypted Channel

Resource Development

T1583 Acquire Infrastructure

Remediation for Operation RapidRust

Immediate actions

• Block and null-route the identified typosquat domains (theprints.org, indiatodays.org, officialinfo.org) and the Backblaze B2 staging URLs at DNS/web-proxy layer
• Hunt for and remove scheduled tasks named 'StandAloneOneDriveUpdater-2626' and 'MicrosoftEdgeUpdateTaskUserS-1-5-24-' across the estate
• Alert on/block outbound HTTPS from endpoints to api.github.com combined with the HCENC1: base64 payload pattern or unexplained private-repository activity
• Disable Autorun/AutoPlay for removable media, especially on systems bridging or adjacent to air-gapped network segments
• Search for and quarantine files matching the disclosed SHA256/MD5 hashes for DriverInstaller.zip/exe and Automata-20.zip/exe

Workarounds

• Enable PowerShell Constrained Language Mode and Script Block Logging to increase visibility into PSNATCH-style exfiltration scripts
• Monitor for the custom 'SmartUploader' User-Agent string and for GitHub Contents API upload traffic originating from endpoints

Longer-term hardening

• Deploy EDR with USB/removable-media device control and behavioral detection to catch RUSTYMOVE-style staging onto external media
• Implement egress allow-listing for cloud services (GitHub, Backblaze B2 and other object-storage providers) on government/defense network segments that have no legitimate need for them
• Enforce SMB null-session hardening and Windows Admin Share restrictions to blunt lateral movement via net use \\IP\IPC$
• Run user-awareness training on typosquatted news-domain lures and unsolicited copy-paste PowerShell execution prompts
• Enforce strict one-way/data-diode controls and physical media policy for air-gapped systems to reduce RUSTYMOVE propagation risk

Affected and fixed versions

• Microsoft — Windows (64-bit)
  Vulnerable versions: all 64-bit Windows versions targeted by RUSTYSHADE, RUSTYMOVE, and PSNATCH
• Generic — Linux
  Vulnerable versions: Linux systems targeted by BASHNATCH

Timeline of Operation RapidRust

• 2026-01-01 Zscaler ThreatLabz reports APT36 activity tracked since at least January 2026, preceding Operation RapidRust.
• 2026-05-11 Typosquat domain locked-ioc-22, impersonating theprint.in, registered via NameCheap.
• 2026-08-01 Operation RapidRust activity observed by Zscaler ThreatLabz during August 2026, targeting government and defense organizations in India and Afghanistan.
• 2026-08-17 Typosquat domain locked-ioc-21, impersonating indiatoday.in, registered via NameCheap.
• 2026-08-20 Post-compromise reconnaissance, lateral movement, and persistence activity begins on compromised hosts (operating 4:00-11:00 AM UTC, weekdays).
• 2026-09-01 Observed post-compromise activity window for Operation RapidRust concludes.
• 2026-09-16 Zscaler ThreatLabz publishes 'Operation RapidRust' technical report disclosing locked-ioc-24, locked-ioc-25, locked-ioc-27, locked-ioc-26, and associated IOCs.

Sources cited for Operation RapidRust

• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH zscaler.com · Vendor report · 2026-09-16
• Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM (Group G0134) MITRE · Research · 2026-09-16
• Transparent Tribe APT Infrastructure Mapping - Part 2 team-cymru.com · Research · 2026-09-16
• APT Profile: Transparent Tribe aka APT36 cyfirma.com · Research · 2026-09-16
• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH malware.news · Blog · 2026-09-16
• Dark Web Profile: APT36 socradar.io · Blog · 2026-09-16
• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH securityboulevard.com · News · 2026-09-16

More in apt

• CRAFTY FALCON targets Indian fintechs via exposed APIs during weekends and low-monitoring periods
• APT29 Watering-Hole Campaign Against Mongolian Government Sites Using iOS WebKit and Chrome Android Exploits (CVE-2023-41993, CVE-2024-5274, CVE-2024-4671)
• Chinese Nation-State Threat Activity Falls 41.4% in Q2-Q3 2026 While Remaining Above Russian and Iranian Activity (Trellix)
• APT29 (Midnight Blizzard) watering holes target iOS and Android devices with n-day exploit chains (DarkSword, AndroSnitch)
• Gorbag: Russia-aligned espionage group targets Ukrainian war crimes investigations and military aid routes (BeautyStealer, Prime ReverseShell, CVE-2025-8088)