Transparent Tribe targets India, Afghanistan with new malware in Operation RapidRust

A Pakistan-aligned threat group, known as Transparent Tribe or APT36, has been linked to a new wave of cyberattacks targeting government and defense organizations in India and Afghanistan, according to Zscaler ThreatLabz. The campaign, dubbed Operation RapidRust, utilizes previously undocumented tools, indicating the group's continued evolution and high operational tempo, with further coverage provided by The Hacker News.

The attacks leverage four new malware families: RUSTYSHADE, a Rust-based backdoor using private GitHub repositories for command and control (C2); PSNATCH, a PowerShell file stealer for Windows; BASHNATCH, a bash script file stealer for Linux; and RUSTYMOVE, a USB propagation tool for Windows. Transparent Tribe employs typosquatted domains impersonating Indian news outlets like The Print and India Today to host malicious PowerShell scripts.

RUSTYSHADE communicates via specific files within GitHub repositories, storing encrypted commands and exfiltrating data like screenshots and webcam captures. PSNATCH and BASHNATCH scan for and steal recently modified documents. RUSTYMOVE spreads RUSTYSHADE via USB drives. The group's activity, primarily observed between August 20 and September 1, 2026, shows C2 commands issued only on weekdays during specific UTC hours, highlighting a calculated approach to its operations against critical infrastructure.

Source: The Hacker News