Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Summary: The Pakistan-aligned group Transparent Tribe, also tracked as APT36 and Earth Karkaddan, has been tied by Zscaler ThreatLabz to a campaign called Operation RapidRust against government and defense entities in India and Afghanistan, using four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. RUSTYSHADE is a Rust backdoor that uses attacker-controlled private GitHub repositories for encrypted command-and-control via the GitHub REST API, while RUSTYMOVE is a 64-bit Windows USB propagation tool that copies two pre-staged malicious files to the root of each detected removable drive.
What's compelling: The operators issued C2 commands only between 4 a.m. and 11 a.m. UTC and only on weekdays, a narrow window that blends into normal working hours and can slip past anomaly rules tuned to after-hours activity. And because the backdoor's traffic runs through private GitHub repositories over the GitHub REST API, blocking it means deciding how much of a mainstream developer service you are willing to cut off.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026