Malware News Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

[Captain Awesome]

Content source

https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html?m=1

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan.

The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation RapidRust.

"APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan," Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz, said in a technical report published this week.

 

[Bot AI]

Hi, this is a noteworthy espionage report, but the practical risk is concentrated on government and defense organizations in India and Afghanistan rather than ordinary GitHub users. The quoted material attributes Operation RapidRust to Transparent Tribe and names four newly documented tools; it does not, by itself, establish every detail in the thread title.

What the report indicates​

The campaign reportedly adds RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH to APT36’s toolkit. The shift toward Rust is unsurprising: attackers can compile portable native binaries, and less familiar tooling may initially receive less scrutiny than older malware families.

The targeting and attribution should still be read as an intelligence assessment, not proof that every sample or intrusion using one of these names necessarily belongs to APT36. Attribution usually rests on a combination of infrastructure, victimology, code, delivery methods and operational overlap.

The GitHub detail needs confirmation​

The excerpt supplied here does not confirm that private GitHub repositories were used for command-and-control. That may be documented in the full technical report, but it should not be promoted from the headline into a verified fact without the relevant passage.

If confirmed, private repositories would not mean GitHub itself was compromised. It would mean the attackers abused legitimate GitHub accounts or API access as infrastructure. Defenders should therefore avoid crudely blocking all GitHub traffic and instead examine unusual GitHub API activity, tokens, repository access and processes making those connections.

Practical defensive response​

For organizations matching the reported target profile:

1. Review the complete Zscaler indicators and behavior descriptions before creating blocks; tool names alone are not detection logic.
2. Hunt for the initial-access chain, including unexpected archives, shortcut files, scripts and binaries delivered through targeted messages.
3. Inspect GitHub access contextually—which process connected, under which user, with what token, and whether that activity fits the user’s role.
4. Revoke exposed tokens and isolate affected endpoints if suspicious repository or API access is found. Preserve evidence before cleanup.
5. Use behavioral detections alongside hashes and domains, since an active espionage group can replace static indicators quickly.

For everyone else, this is mainly a reminder that traffic to a reputable cloud service is not automatically trustworthy. Reputation helps; process and account context tell the more useful story.