Loading story…
Pakistan-linked APT36 targeted government and defense organizations in India and Afghanistan in Operation RapidRust, deploying the Rust-based Windows backdoor RUSTYSHADE, the removable-media propagation tool RUSTYMOVE, and the Windows and Linux file stealers PSNATCH and BASHNATCH. RUSTYSHADE used attacker-controlled private GitHub repositories and the GitHub REST API for AES-256-GCM-encrypted command-and-control, while the stealers collected recently modified files from user folders and drives and incrementally exfiltrated them to per-victim private GitHub repositories.
Operators used Backblaze-hosted payloads and typosquatted domains impersonating Indian media outlets, then conducted host and network reconnaissance, public-IP geolocation, network-share enumeration, and SMB/RPC and IPC$ connectivity attempts. They established persistence through a masqueraded logon scheduled task, collected screenshots and webcam images, and removed deployed-tool artifacts during cleanup. RUSTYMOVE copied a RUSTYSHADE archive and malicious shortcut to USB devices, creating a potential route for propagation into isolated or air-gapped environments.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
From August 20 through September 1, APT36 conducted host, user, network, and public-IP geolocation reconnaissance; deployed payloads from Backblaze-hosted infrastructure; and created masqueraded OneDrive and Microsoft Edge updater scheduled tasks for persistence. Operators enumerated SMB/RPC-exposed systems and shares, attempted IPC$ access with null sessions and administrator credentials, propagated payloads via removable drives, and deleted or renamed tool artifacts for cleanup.
APT36 registered indiatodays.org, impersonating indiatoday.in, for campaign infrastructure and payload staging.
Pakistan-nexus APT36 conducted Operation RapidRust targeting government and defense entities in India and Afghanistan. The campaign deployed the Rust-based RUSTYSHADE backdoor and RUSTYMOVE removable-media propagation tool, plus the PSNATCH and Linux-focused BASHNATCH file stealers, using private GitHub repositories for C2 and exfiltration.
APT36 registered theprints.org, a domain impersonating Indian news outlet theprint.in, for Operation RapidRust infrastructure.
Zscaler ThreatLabz published its analysis attributing Operation RapidRust to APT36 and documenting RUSTYSHADE's GitHub REST API-based AES-256-GCM-encrypted C2, the PSNATCH/BASHNATCH GitHub exfiltration workflow, and RUSTYMOVE's removable-media propagation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcezscaler.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active cyber espionage campaign linked with moderate confidence to **APT36** (Transparent Tribe) that is targeting telecom, government, defense, energy, and other critical infrastructure organizations across South Asia, including lures tied to **Afghan Telecom**, government updates, and software installers. The operation uses a malware cluster that includes **HACKERAI C2 Agent**, **PATCHCORD**, and **SHEETCORD**, showing an evolution from earlier custom C/C++ tooling to newer **Go-based implants**. The malware uses legitimate cloud services as covert command-and-control channels, with **HACKERAI** abusing **GitHub Gists** and **SHEETCORD** using **Google Sheets** for command traffic and possible data exfiltration. Researchers said HACKERAI can gather system information, execute remote commands, and maintain persistence by modifying browser shortcuts while still opening the legitimate browser to avoid suspicion; published defensive leads include suspicious GitHub activity, altered browser shortcuts, malicious ZIP or installer files, and a set of reported IOCs including domains, an IP address, and multiple `SHA-256` hashes.
Aug 26, 2026
Arctic Wolf reported an **India-nexus espionage campaign** attributed to **SloppyLemming** (aka *Outrider Tiger* / *Fishing Elephant*) targeting government entities and critical infrastructure operators in **Pakistan and Bangladesh** (with additional reporting noting **Sri Lanka**). The activity, tracked from **January 2025 to January 2026**, used two main infection chains: (1) **PDF lure documents** that redirected victims to **ClickOnce** manifests, deploying a **DLL sideloading** package using a legitimate `.NET` runtime executable (`NGenTask.exe`) alongside a malicious loader (`mscorsvc.dll`) that decrypted and executed a custom x64 shellcode implant dubbed **BurrowShell**; and (2) **macro-enabled Excel** lures delivering a **Rust-based** keylogger/recon tool with capabilities including port scanning and network enumeration. BurrowShell was described as a full-featured backdoor enabling file operations, screenshot capture, remote shell execution, and **SOCKS proxy** tunneling, while attempting to blend in by masquerading C2 as **Windows Update** traffic and using **RC4** with a 32-character key for payload protection. Infrastructure analysis tied the campaign to **112 Cloudflare Workers domains** registered during the tracking period—an expansion in scale compared to prior public reporting—and included government-themed domain naming intended to increase victim trust. Reported targets included Pakistani nuclear regulatory and defense-adjacent organizations (e.g., the **Pakistan Nuclear Regulatory Authority**, **Pakistan Navy**, and logistics/telecom entities) and Bangladeshi energy and financial-sector organizations (including power grid/utility operators). Arctic Wolf assessed the actor as moderately capable, citing multi-stage execution and defense evasion knowledge alongside operational security lapses (e.g., exposed directories), and noted the activity as an expansion of threat activity previously identified publicly by Cloudflare.
Jun 29, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026