Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets
Operation RapidRust (TL-2026-2545), also tracked as Operation RapidRust, is a high-severity advanced persistent threat campaign, first published 2026-09-16. It is attributed to APT36 (Pakistan) with high confidence, affects Microsoft Windows (64-bit), maps to 16 MITRE ATT&CK techniques (T1005, T1018, T1021), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-2545
- Threat ID
- TL-2026-2545
- Also known as
- Operation RapidRust
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-09-16
- Last reviewed
- 2026-09-16
- Attribution
- APT36
- Attribution confidence
- HIGH
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, military
- Target regions
- South Asia, india, afghanistan
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Operation RapidRust
Malware and tooling: BASHNATCH, PSNATCH, RUSTYMOVE, RUSTYSHADE, GitHub REST/Contents API
Zscaler ThreatLabz disclosed Operation RapidRust, an August 2026 campaign by Pakistan-nexus threat actor APT36 (Transparent Tribe) against government and defense organizations in India and Afghanistan, deploying four new tools: the Rust backdoor RUSTYSHADE (GitHub REST API C2 with AES-256-GCM), the Rust USB-propagation tool RUSTYMOVE (built to bridge air-gapped networks), and the PowerShell/Bash file-stealer pair PSNATCH/BASHNATCH.
How Operation RapidRust works
APT36 (Transparent Tribe), a Pakistan-nexus cyber-espionage actor tracked by Zscaler ThreatLabz since at least January 2026, ran Operation RapidRust in August 2026 against government and defense-sector targets in India and Afghanistan. The actor lured victims through typosquatted domains impersonating Indian news outlets (theprints[.]org mimicking theprint.in, indiatodays[.]org mimicking indiatoday.in, and officialinfo[.]org), all registered through NameCheap, and staged PowerShell downloader commands (`powershell wget <url> -o ww.zip`) that pulled ZIP archives from Backblaze B2 cloud storage (f005.backblazeb2.com, clients-easy.s3.us-east-005.backblazeb2.com).
The operation introduced four new tools. RUSTYSHADE is a 64-bit Windows Rust backdoor that abuses attacker-controlled private GitHub repositories as its command-and-control channel via the GitHub REST API, authenticating with hardcoded Personal Access Tokens and deriving a 32-byte AES key from the SHA-256 hash of that PAT to encrypt traffic with AES-256-GCM (message format `HCENC1:[base64(nonce||ciphertext||tag)]`, nonces generated with BCryptGenRandom). It synchronizes commands and results through repository files (command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, download.bin) and supports screenshot capture (ss_up), webcam capture (CAP-photo), directory/drive enumeration (HC_LIST, HC_DRIVES), file exfiltration (HC_DOWNLOAD), and arbitrary command execution (run).
RUSTYMOVE is a companion 64-bit Windows Rust binary purpose-built to bridge air-gapped networks: it continuously enumerates newly attached removable media (USB, SD, MMC, IEEE 1394) by BusType/MediaType, tracks previously infected volumes by UniqueId to avoid re-infection, and copies pre-staged malicious files (DriverInstaller.zip, and the LNK lure DocScanner-11-Aug-2026-5-37pm.pdf.LNK) onto them. Persistence on infected hosts is established via scheduled tasks masquerading as legitimate update services ("StandAloneOneDriveUpdater-2626", "MicrosoftEdgeUpdateTaskUserS-1-5-24-") that trigger at user logon.
PSNATCH (PowerShell) and BASHNATCH (its Bash/Linux counterpart) are file-stealing tools that scan Desktop, Downloads, Documents, and OneDrive folders plus mapped drives D:-H: for documents, images, archives, media, executables, scripts, and databases modified within the last 120 days, then exfiltrate them (capped at 1 GB per file / 5 GB per run) directly into per-machine private GitHub repositories via the GitHub Contents API, using a custom "SmartUploader" user agent and a local JSON tracking file to avoid re-uploading.
Post-compromise activity observed between August 20 and September 1, 2026 (operating 4:00 AM-11:00 AM UTC on weekdays, consistent with Pakistan-based operator hours) included extensive host and network reconnaissance (ipconfig, whoami, tasklist, hostname, arp -a, subnet ping sweeps across 1-254, nbtstat, net view, SMB/RPC port checks on 445/135, and IP-geolocation lookups against ip-api.com/ipinfo.io/ipapi.co), lateral movement via null and authenticated SMB sessions (net use \\[IP]\IPC$), and anti-forensic cleanup through deletion and renaming of staged artifacts (e.g., om.zip renamed to DriverInstaller.zip, followed by deletion of intermediate files). No CVE or software vulnerability underlies this campaign; the operation relies entirely on social-engineering delivery, abuse of legitimate cloud services (GitHub, Backblaze B2) for C2/exfiltration, and physical/removable-media propagation.
MITRE ATT&CK techniques used in TL-2026-2545
Collection
T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture
Discovery
T1018 Remote System Discovery; T1082 System Information Discovery; T1135 Network Share Discovery
Lateral Movement
T1021 Remote Services; T1091 Replication Through Removable Media
Defense Evasion
Persistence
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Command and Control
Resource Development
Affected products and versions in Operation RapidRust
- Microsoft — Windows (64-bit)
Vulnerable versions: all 64-bit Windows versions targeted by RUSTYSHADE, RUSTYMOVE, and PSNATCH - Generic — Linux
Vulnerable versions: Linux systems targeted by BASHNATCH
Remediation for Operation RapidRust
Immediate actions
- Block and null-route the identified typosquat domains (theprints.org, indiatodays.org, officialinfo.org) and the Backblaze B2 staging URLs at DNS/web-proxy layer
- Hunt for and remove scheduled tasks named 'StandAloneOneDriveUpdater-2626' and 'MicrosoftEdgeUpdateTaskUserS-1-5-24-' across the estate
- Alert on/block outbound HTTPS from endpoints to api.github.com combined with the HCENC1: base64 payload pattern or unexplained private-repository activity
- Disable Autorun/AutoPlay for removable media, especially on systems bridging or adjacent to air-gapped network segments
- Search for and quarantine files matching the disclosed SHA256/MD5 hashes for DriverInstaller.zip/exe and Automata-20.zip/exe
Workarounds
- Enable PowerShell Constrained Language Mode and Script Block Logging to increase visibility into PSNATCH-style exfiltration scripts
- Monitor for the custom 'SmartUploader' User-Agent string and for GitHub Contents API upload traffic originating from endpoints
Longer-term hardening
- Deploy EDR with USB/removable-media device control and behavioral detection to catch RUSTYMOVE-style staging onto external media
- Implement egress allow-listing for cloud services (GitHub, Backblaze B2 and other object-storage providers) on government/defense network segments that have no legitimate need for them
- Enforce SMB null-session hardening and Windows Admin Share restrictions to blunt lateral movement via net use \\IP\IPC$
- Run user-awareness training on typosquatted news-domain lures and unsolicited copy-paste PowerShell execution prompts
- Enforce strict one-way/data-diode controls and physical media policy for air-gapped systems to reduce RUSTYMOVE propagation risk
Timeline of Operation RapidRust
- Zscaler ThreatLabz reports APT36 activity tracked since at least January 2026, preceding Operation RapidRust.
- Typosquat domain theprints[.]org, impersonating theprint.in, registered via NameCheap.
- Operation RapidRust activity observed by Zscaler ThreatLabz during August 2026, targeting government and defense organizations in India and Afghanistan.
- Typosquat domain indiatodays[.]org, impersonating indiatoday.in, registered via NameCheap.
- Post-compromise reconnaissance, lateral movement, and persistence activity begins on compromised hosts (operating 4:00-11:00 AM UTC, weekdays).
- Observed post-compromise activity window for Operation RapidRust concludes.
- Zscaler ThreatLabz publishes 'Operation RapidRust' technical report disclosing RUSTYSHADE, RUSTYMOVE, PSNATCH, BASHNATCH, and associated IOCs.
Sources cited for Operation RapidRust
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
- Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
- Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM (Group G0134)
- Transparent Tribe APT Infrastructure Mapping - Part 2
- APT Profile: Transparent Tribe aka APT36
- Dark Web Profile: APT36
More in apt
- NightEagle (APT-Q-95) Deploys GhostContainer Backdoor on Exchange, Exploits BlueKeep (CVE-2019-0708) and DCSync to Compromise Russian Active Directory
- North Korean WaterPlum (Contagious Interview) Campaign Infects 30,000 Devices, Steals $10.71M in Crypto via Fake Job Interviews and npm/PyPI/Go/Rust Supply-Chain Packages
- North Korean WaterPlum (Contagious Interview) Hackers Target IT Professionals with BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle Malware
- SilkParasite Infrastructure Links SpiceRAT, NodeEdgeRAT, and NomadRAT to Four-Year China-Nexus Campaign Against Central Asian Governments
- Red Heron Weaponizes Gitea RCE (CVE-2026-60004) with JITTERLY Implant and SIXZUT Rootkit
Detection coverage for TL-2026-2545
As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2545 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2545
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.