Zscaler reports that APT36 ran Operation RapidRust in August 2026, targeting government and defense organizations in India and Afghanistan with new tooling including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The campaign used private GitHub repositories, typosquatted Indian media domains, and Backblaze-hosted payloads to enable encryption, exfiltration, persistence, and USB-based propagation. #APT36 #RUSTYSHADE #RUSTYMOVE #PSNATCH #BASHNATCH #GitHub #Backblaze
Keypoints
- APT36, a Pakistan-nexus threat actor, was observed in August 2026 conducting Operation RapidRust against government and defense organizations in India and Afghanistan.
- RUSTYSHADE is a new Rust-based Windows backdoor that uses attacker-controlled private GitHub repositories for C2 and AES-256-GCM to encrypt communications.
- RUSTYMOVE is a Rust-based USB propagation tool that copies pre-staged malicious files to removable media to help spread into air-gapped environments.
- PSNATCH is a PowerShell file-stealing tool that targets Windows systems, while BASHNATCH is its Linux variant for similar exfiltration activity.
- APT36 used typosquatted domains impersonating Indian media outlets to stage PowerShell scripts and next-stage payloads, alongside Backblaze-hosted archives.
- The threat actor also performed reconnaissance, network mapping, scheduled-task persistence, lateral movement attempts, and anti-forensics actions during post-compromise activity.
MITRE Techniques
- [T1105] Ingress Tool Transfer – APT36 downloaded payloads and tooling from external infrastructure to compromised systems, including Backblaze-hosted ZIP files and staged scripts (‘wget https://…/DriverInstaller.zip’ and ‘wget …/Automata-20.zip’).
- [T1027] Obfuscated Files or Information – RUSTYSHADE encrypted C2 messages with AES-256-GCM and Base64, then prefixed them with HCENC1 to conceal communications (‘All messages exchanged … are encrypted using AES-256-GCM’ and ‘HCENC1:[base64(nonce || ciphertext || tag)]’).
- [T1071.001] Web Protocols – RUSTYSHADE used the GitHub REST API over HTTPS as its C2 channel (‘uses the GitHub REST API as its C2 channel’).
- [T1584.001] Compromise Infrastructure: Domains – APT36 registered and used typosquatted domains impersonating Indian media organizations (‘theprints[.]org’ and ‘indiatodays[.]org’).
- [T1091] Replication Through Removable Media – RUSTYMOVE monitored removable drives and copied malicious files to USB, SD, MMC, and IEEE 1394 media (‘copy the following two pre-staged malicious files to the root directory of each detected external drive’).
- [T1053.005] Scheduled Task/Job: Scheduled Task – APT36 created scheduled tasks for persistence and to launch payloads at logon (‘Register-ScheduledTask … -AtLogOn’ and ‘schtasks /Create … /SC ONLOGON’).
- [T1018] Remote System Discovery – The operators enumerated live hosts on the local network using ping sweeps, hostname lookups, and network-share discovery (‘Map the local network by sweeping subnets for live hosts’).
- [T1046] Network Service Discovery – They probed ports 445 and 135 to identify systems suitable for lateral movement (‘Test-NetConnection [IP] -Port 445’ and ‘Port 135’).
- [T1021.002] SMB/Windows Admin Shares – APT36 attempted lateral movement by connecting to IPC$ shares on remote hosts (‘net use [IP]IPC$’).
- [T1074.001] Local Data Staging: Local Data Staging – PSNATCH organized and staged collected files in date-stamped folders before exfiltration (‘Organizes exfiltrated data into date-stamped folders’).
- [T1560.001] Archive Collected Data: Archive via Utility – RUSTYSHADE compressed files with Compress-Archive before exfiltration (‘compress it using Compress-Archive’).
- [T1070.004] File Deletion – The threat actor removed tooling and traces using delete commands (‘del yogi.zip, del DriverInstaller.exe, del HealthCheck.exe’).
Indicators of Compromise
- [SHA-256 hashes] Sample files and payloads linked to RUSTYSHADE and RUSTYMOVE – 40a75f87f1e52c33df9ca733aaf8ebbb00aff1a72c5d5635ab36ce2eb370718a, f0557a052d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31b, and 2 more hashes.
- [File names] Malware and staging archives used in the campaign – DriverInstaller.zip, DriverInstaller.exe, and 2 more files.
- [File names] USB propagation payloads and scheduled-task artifacts – Automata-20.zip, Automata-20.exe, and 1 more file.
- [Domains] Malicious payload staging and impersonation domains – theprints[.]org, indiatodays[.]org, and officialinfo[.]org.
- [URLs] Payload staging paths on threat-actor infrastructure – theprints[.]org/adrive, theprints[.]org/drivefolder, and 3 more paths.
- [URLs] Backblaze-hosted download locations for malicious archives – hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip, hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip.
- [Scheduled task names] Persistence artifacts used by APT36 – StandAloneOneDriveUpdater-2626, MicrosoftEdgeUpdateTaskUserS-1-5-24-…, and other related task entries.