# Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Against India and Afghanistan Government/Defense Targets

> Zscaler ThreatLabz disclosed Operation RapidRust, an August 2026 campaign by Pakistan-nexus threat actor APT36 (Transparent Tribe) against government and defense organizations in India and Afghanistan, deploying four new tools: the Rust backdoor RUSTYSHADE (GitHub REST API C2 with AES-256-GCM), the Rust USB-propagation tool RUSTYMOVE (built to bridge air-gapped networks), and the PowerShell/Bash file-stealer pair PSNATCH/BASHNATCH.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2545
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-operation-rapidrust-tl-2026-2545.webp?v=2d999c87 (Threadlinqs threat intel: APT36 Operation RapidRust: Detection & IOCs (TL-2026-2545) — High severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-2545
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT36 (Pakistan)
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

APT36 (Transparent Tribe), a Pakistan-nexus cyber-espionage actor tracked by Zscaler ThreatLabz since at least January 2026, ran Operation RapidRust in August 2026 against government and defense-sector targets in India and Afghanistan. The actor lured victims through typosquatted domains impersonating Indian news outlets (theprints[.]org mimicking theprint.in, indiatodays[.]org mimicking indiatoday.in, and officialinfo[.]org), all registered through NameCheap, and staged PowerShell downloader commands (`powershell wget <url> -o ww.zip`) that pulled ZIP archives from Backblaze B2 cloud storage (f005.backblazeb2.com, clients-easy.s3.us-east-005.backblazeb2.com).

The operation introduced four new tools. RUSTYSHADE is a 64-bit Windows Rust backdoor that abuses attacker-controlled private GitHub repositories as its command-and-control channel via the GitHub REST API, authenticating with hardcoded Personal Access Tokens and deriving a 32-byte AES key from the SHA-256 hash of that PAT to encrypt traffic with AES-256-GCM (message format `HCENC1:[base64(nonce||ciphertext||tag)]`, nonces generated with BCryptGenRandom). It synchronizes commands and results through repository files (command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, download.bin) and supports screenshot capture (ss_up), webcam capture (CAP-photo), directory/drive enumeration (HC_LIST, HC_DRIVES), file exfiltration (HC_DOWNLOAD), and arbitrary command execution (run).

RUSTYMOVE is a companion 64-bit Windows Rust binary purpose-built to bridge air-gapped networks: it continuously enumerates newly attached removable media (USB, SD, MMC, IEEE 1394) by BusType/MediaType, tracks previously infected volumes by UniqueId to avoid re-infection, and copies pre-staged malicious files (DriverInstaller.zip, and the LNK lure DocScanner-11-Aug-2026-5-37pm.pdf.LNK) onto them. Persistence on infected hosts is established via scheduled tasks masquerading as legitimate update services ("StandAloneOneDriveUpdater-2626", "MicrosoftEdgeUpdateTaskUserS-1-5-24-") that trigger at user logon.

PSNATCH (PowerShell) and BASHNATCH (its Bash/Linux counterpart) are file-stealing tools that scan Desktop, Downloads, Documents, and OneDrive folders plus mapped drives D:-H: for documents, images, archives, media, executables, scripts, and databases modified within the last 120 days, then exfiltrate them (capped at 1 GB per file / 5 GB per run) directly into per-machine private GitHub repositories via the GitHub Contents API, using a custom "SmartUploader" user agent and a local JSON tracking file to avoid re-uploading.

Post-compromise activity observed between August 20 and September 1, 2026 (operating 4:00 AM-11:00 AM UTC on weekdays, consistent with Pakistan-based operator hours) included extensive host and network reconnaissance (ipconfig, whoami, tasklist, hostname, arp -a, subnet ping sweeps across 1-254, nbtstat, net view, SMB/RPC port checks on 445/135, and IP-geolocation lookups against ip-api.com/ipinfo.io/ipapi.co), lateral movement via null and authenticated SMB sessions (net use \\[IP]\IPC$), and anti-forensic cleanup through deletion and renaming of staged artifacts (e.g., om.zip renamed to DriverInstaller.zip, followed by deletion of intermediate files). No CVE or software vulnerability underlies this campaign; the operation relies entirely on social-engineering delivery, abuse of legitimate cloud services (GitHub, Backblaze B2) for C2/exfiltration, and physical/removable-media propagation.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1091 Replication Through Removable Media
- T1036 Masquerading
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1021 Remote Services
- T1113 Screen Capture
- T1125 Video Capture
- T1005 Data from Local System
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain** (`TL-2026-2545-SPL-003`)

Detects Operation RapidRust's command-and-control and exfiltration abuse of GitHub's legitimate REST/Contents API — RUSTYSHADE's AES-256-GCM 'HCENC1:' encoded command/result sync via command.txt/results.txt/info.txt/heartbeat.txt/screenshot.png/webcam_photo.jpg/download.bin in attacker-controlled private repos, and PSNATCH/BASHNATCH's file exfiltration under the custom 'SmartUploader' User-Agent — together with the post-compromise host/network reconnaissance (ipconfig, whoami, tasklist, arp -a, subnet ping sweeps, nbtstat, net view, IP-geolocation lookups) and null/authenticated SMB lateral movement (net use \\[IP]\IPC$) observed between 2026-08-20 and 2026-09-01 during Pakistan-business-hours (04:00-11:00 UTC) operator windows. Community OSINT (TL_OSINT_Scan) corroborates the RUSTYSHADE Backblaze staging URL with a sighting from before this disclosure, and tags the cluster 'mythic' (Mythic C2 framework family association) — factor this into hunting for a Mythic-based fallback C2 alongside the GitHub-API channel.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1573, T1567, T1102, T1021, T1018, T1135, T1082, T1113, T1125, T1005
- **Data sources:** proxy, dns, sysmon, windows_security, netflow
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=network
(http_user_agent="*SmartUploader*")
OR (dest="api.github.com" AND (uri_path="*/contents/*" OR http_method="PUT"))
OR (payload="HCENC1:*")
OR (process="cmd.exe" AND CommandLine IN ("*ipconfig*","*whoami*","*tasklist*","*arp -a*","*nbtstat*","*net view*"))
OR (CommandLine="*net use*" AND CommandLine="*IPC$*")
OR (dest_ip IN ("ip-api.com","ipinfo.io","ipapi.co"))
| eval stage=case(
    match(http_user_agent, "SmartUploader"), "psnatch_bashnatch_exfil",
    match(payload, "HCENC1"), "rustyshade_c2",
    dest="api.github.com", "github_api_c2_exfil",
    match(CommandLine, "IPC\$"), "smb_lateral_movement",
    true(), "host_network_recon")
| table _time, ComputerName, User, src_ip, dest, http_user_agent, CommandLine, stage
| sort -_time
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteUrl has "api.github.com" and (RemoteUrl has "/contents/" or InitiatingProcessCommandLine has "SmartUploader"))
    or RemoteUrl has_any ("ip-api.com", "ipinfo.io", "ipapi.co")
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any ("ipconfig","whoami","tasklist","arp -a","nbtstat","net view")
        or (ProcessCommandLine has "net use" and ProcessCommandLine has "IPC$")
)
| project Timestamp, DeviceName, AccountName, RemoteUrl, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: APT36 RapidRust GitHub-API C2 Channel and SmartUploader Exfiltration
id: 4f2b8a15-9d6c-4e73-a108-5b1e6c9d0f42
status: experimental
description: Detects RUSTYSHADE's GitHub REST API C2 beaconing (HCENC1 AES-256-GCM payload format, repo file sync) and PSNATCH/BASHNATCH exfiltration via the GitHub Contents API using the custom SmartUploader User-Agent, part of Operation RapidRust.
references:
    - https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.command-and-control
    - attack.t1573.001
    - attack.t1102
    - attack.exfiltration
    - attack.t1567.002
    - attack.collection
    - attack.t1113
    - attack.t1125
    - attack.t1005
    - attack.group.g0134
    - attack.tool.mythic
logsource:
    category: proxy
    product: windows
detection:
    selection_ua:
        c-useragent|contains: 'SmartUploader'
    selection_github:
        cs-host: 'api.github.com'
        cs-uri-stem|contains: '/contents/'
    condition: 1 of selection_*
falsepositives:
    - Legitimate internal automation/CI tooling that also uses the GitHub Contents API for unrelated repository uploads (User-Agent match on 'SmartUploader' is highly specific and unlikely to collide)
level: critical
```

**Known false positives:**

- Legitimate developer/CI workflows using the GitHub Contents API from corporate egress could overlap on the generic api.github.com selector; the SmartUploader User-Agent and HCENC1 payload prefix are the high-fidelity narrowing signals
- IT helpdesk or monitoring tools that legitimately call ip-api.com/ipinfo.io/ipapi.co for geolocation should be baselined and excluded

**Tuning notes:** Weight alerts higher when the SmartUploader UA or HCENC1: payload prefix is present versus the bare api.github.com/recon selectors, which are lower-fidelity and should feed a correlation search rather than fire standalone; restrict the recon-command and net-use-IPC$ selectors to the disclosed operator window (04:00-11:00 UTC weekdays) to cut analyst noise, and expand IOC coverage as TL_OSINT_Scan / tweetfeed.live surface new community-sighted sibling infrastructure for this cluster.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) (locked: unlock with TL Creds)
- RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence (locked: unlock with TL Creds)
- RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain (locked: unlock with TL Creds)
- APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) (locked: unlock with TL Creds)
- RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence (locked: unlock with TL Creds)
- RUSTYSHADE GitHub-API C2 Beaconing, PSNATCH/BASHNATCH Exfiltration & Recon/Lateral-Movement Chain (locked: unlock with TL Creds)
- APT36 RapidRust — Typosquat Lure PowerShell Downloader (RUSTYSHADE/RUSTYMOVE Stager) (locked: unlock with TL Creds)
- RUSTYMOVE USB Propagation & Update-Service-Masquerading Scheduled Task Persistence (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- Domain: `theprints[.]org`
- URL: `hxxps://clients-easy[.]s3[.]us-east-005[.]backblazeb2[.]com/Automata-20.zip`
- File hash: `52d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH](https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and)
- [Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH](https://securityboulevard.com/2026/09/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and-bashnatch/)
- [Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH](https://malware.news/t/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and-bashnatch/125646)
- [Transparent Tribe, COPPER FIELDSTONE, APT36, Mythic Leopard, ProjectM (Group G0134)](https://attack.mitre.org/groups/G0134/)
- [Transparent Tribe APT Infrastructure Mapping - Part 2](https://www.team-cymru.com/post/transparent-tribe-apt-infrastructure-mapping)
- [APT Profile: Transparent Tribe aka APT36](https://www.cyfirma.com/research/apt-profile-transparent-tribe-aka-apt36/)
- [Dark Web Profile: APT36](https://socradar.io/blog/dark-web-profile-apt36/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2545