New Rust backdoor uses private GitHub repos for C2

A new Rust backdoor found by Zscaler ThreatLabz hides its command-and-control traffic inside private GitHub repositories, one of four previously undocumented tools the security vendor has tied to a campaign it calls Operation RapidRust. ThreatLabz attributes the activity to Transparent Tribe, also tracked as APT36 and Earth Karkaddan, and says the attacks in this campaign targeted government and defense organizations in India and Afghanistan, according to the vendor's technical report published this week.

Command-and-control, usually shortened to C2, is the channel an intruder uses to send instructions to an infected machine and to receive whatever it steals; a backdoor is a hidden way of keeping access to a computer after the first break-in. What stands out about the implant, named RUSTYSHADE, is where that channel lives. Instead of contacting a dedicated server, it reads and writes files in an attacker-controlled private repository on GitHub, the code hosting service, through the GitHub REST API, a documented interface that lets software work with repositories automatically. The implant relies on a fixed set of file names for the exchange: command.txt for encrypted instructions, results.txt for encrypted output, info.txt for system reconnaissance data, heartbeat.txt to confirm the machine is still infected, screenshot.png and webcam_photo.jpg for encrypted screen and camera captures, and download.bin for encrypted files taken from the computer. The commands it accepts allow it to take screenshots, capture a webcam photo, perform file operations and run commands in the background. Zscaler notes that RUSTYSHADE shares some functionality with GITSHELLPAD, a backdoor written in the Golang language that was observed in September 2025 in a campaign known as Gopher Strike. Rust, for readers who do not follow programming, is a language often chosen for malware because the finished programs are comparatively hard to take apart and inspect.

The four tools divide into three roles. RUSTYSHADE is the backdoor, RUSTYMOVE is a lateral movement utility, meaning a tool for spreading from one compromised machine to others, and the remaining two, PSNATCH and BASHNATCH, are file-stealing programs built for Windows and Linux respectively. Both stealers are fetched after the initial compromise from an attacker-controlled GitHub gist, which is a small snippet of code stored on the same platform. PSNATCH is a PowerShell stealer; PowerShell is a scripting tool built into Windows that administrators use to automate routine tasks and that attackers abuse for much the same reason. It searches a preconfigured list of folders for Microsoft Office documents, images, archives, media files, executables, scripts and databases that were modified within the previous three months, then uploads them to a private repository named after the infected machine. The report sets two limits on that collection, 1 GB per file and 5 GB per execution. BASHNATCH performs a comparable job on Linux systems using a bash script.

The third tool, RUSTYMOVE, is a lightweight 64-bit Windows program written in Rust whose job is to spread the operation through removable media. It continuously watches for external drives being connected, using a PowerShell script, and copies two prepared files to the root folder of every drive it detects. The first is DriverInstaller.zip, which contains RUSTYSHADE. The second is DocScanner-11-Aug-2026-5-37pm.pdf.LNK, a Windows shortcut file that Zscaler suspects contains a command to launch RUSTYSHADE after the archive has been extracted. In practical terms, an infected computer turns every USB stick plugged into it into a carrier, which is why campaigns of this kind matter well beyond the organizations first targeted.

Zscaler also describes how the operators tried to draw victims in. The report lists two lookalike, or typosquatted, domains registered to impersonate Indian news organizations and to host malicious PowerShell scripts and payloads. The first, theprints[.]org, imitates The Print, whose real domain is theprint[.]in. The second, indiatodays[.]org, imitates India Today, whose real domain is indiatoday[.]in. Typosquatting means registering a web address close enough to a trusted one that a reader is unlikely to notice the difference, and it is a common way to get a victim to open a file or run a script without suspicion.

The operators also worked to a schedule. Post-compromise activity began with system, user and network reconnaissance, followed by the deployment of next-stage payloads, and a significant portion of the actions took place between August 20 and September 1, 2026. The C2 commands were issued only between 4 a.m. and 11 a.m. UTC and only on weekdays. The findings follow separate attribution work: a little over a month earlier, the Acronis Threat Research Unit tied the same long-running group to another campaign aimed at Afghan telecom providers and South Asian critical infrastructure organizations, which used a backdoor called PATCHCORD. Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz, said the campaign shows that APT36 "continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs". TTPs is shorthand for tactics, techniques and procedures, the recurring methods an intrusion group uses.

For website owners and IT teams, the mechanisms described here are worth understanding even if the targets named in the report are far from their own sector. Renting space on a mainstream service such as GitHub, or registering a domain that looks like a news site, costs an attacker very little and can make malicious traffic blend into ordinary business activity, which is exactly what makes it hard to spot with network rules alone. Removable media remain a live infection route, and script-based stealers such as PSNATCH rely on files and documents that everyday staff handle without a second thought. Where an organization wants that kind of defensive groundwork handled by specialists rather than in-house, AEU-I provides security-first IT, infrastructure and consulting services, and its service page sets out exactly what it covers.

Nothing in the Zscaler report suggests that the tools described here are widely available or that they have been used indiscriminately, and the report does not state that any specific victim organization has been named publicly. What it does show is a group that keeps refreshing its tooling, moving its hidden communications onto services nobody blocks outright and waiting for a single click on a lookalike link or a borrowed USB stick. That is a reminder that the weakest link in these campaigns is rarely the technology itself.