Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Transparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains. The campaign relies on private GitHub repositories, Rust-based backdoors, and cross-platform stealers to support stealthy command-and-control, data theft, and USB-based propagation. #TransparentTribe #APT36 #EarthKarkaddan #OperationRapidRust #RUSTYSHADE #RUSTYMOVE #PSNATCH #BASHNATCH

Keypoints

  • Transparent Tribe targeted government and defense organizations in India and Afghanistan.
  • The campaign used newly discovered tools including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.
  • Private GitHub repositories were used for encrypted command-and-control communication.
  • Typosquatted domains impersonating Indian news sites hosted malicious PowerShell content.
  • The operators used USB propagation and file-stealing tools to expand access and exfiltrate data.

Read More: https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html