APT36 Operation RapidRust: Deploys Multi-Platform Rust Malware

In August 2026, the Pakistan-nexus threat actor APT36, also known as Transparent Tribe, launched 'Operation RapidRust' targeting government and defense entities in India and Afghanistan. The campaign is characterized by the introduction of several new malware families, including RUSTYSHADE, a Rust-based backdoor, and RUSTYMOVE, a tool designed for USB-based lateral movement. The actor maintains a disciplined operational tempo, with command-and-control (C2) activity occurring exclusively on weekdays between 04:00 and 11:00 UTC.

Technically, the group has shifted toward using Rust for its core implants to evade detection and abuses legitimate services like GitHub private repositories for C2 communications and exfiltration. They utilize typosquatted domains (e.g., indiatodays[.]org) to impersonate Indian news outlets for staging payloads. The malware suite includes specialized file stealers for both Windows (PSNATCH) and Linux (BASHNATCH), indicating a broad cross-platform targeting capability.

The use of RUSTYMOVE to propagate via removable media suggests a focused effort to bridge air-gapped networks within sensitive government environments. Organizations in the targeted regions should prioritize monitoring for GitHub API abuse and the creation of suspicious scheduled tasks masquerading as legitimate software updates.