Transparent Tribe (APT36/Earth Karkaddan) has launched Operation RapidRust against government and defense entities in India and Afghanistan using newly identified tools and typosquatted domains. The campaign relies on private GitHub repositories, Rust-based backdoors, and cross-platform stealers to support stealthy command-and-control, data theft, and USB-based propagation. #TransparentTribe #APT36 #EarthKarkaddan #OperationRapidRust #RUSTYSHADE #RUSTYMOVE #PSNATCH #BASHNATCH
Keypoints
- Transparent Tribe targeted government and defense organizations in India and Afghanistan.
- The campaign used newly discovered tools including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH.
- Private GitHub repositories were used for encrypted command-and-control communication.
- Typosquatted domains impersonating Indian news sites hosted malicious PowerShell content.
- The operators used USB propagation and file-stealing tools to expand access and exfiltrate data.
Read More: https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html