APT36’s New Rust Malware Uses Private GitHub Repos and USB Drives to Reach Isolated Networks

The Pakistan-linked threat group APT36, also known as Transparent Tribe, has a new set of tools written in Rust, and one of them is built to jump into air-gapped networks on USB drives. Zscaler ThreatLabz detailed the campaign, which it calls Operation RapidRust, in a technical report this week.

The researchers observed the activity in August against government and defense organizations in India and Afghanistan. Since Zscaler’s last report on the group in January, it wrote, APT36 “has maintained a high operational tempo and updated their tactics, techniques, and procedures.”

GitHub as a command channel

The main implant, RUSTYSHADE, is a 64-bit Windows backdoor that uses attacker-controlled private GitHub repositories for command and control. A GitHub personal access token is hardcoded in cleartext in the binary, and messages are encrypted with AES-256-GCM using a key derived from that token. Operators commit encrypted commands to a command.txt file, and the malware polls the GitHub REST API, runs them and uploads results. Commands include taking screenshots, capturing a webcam photo, running shell commands and exfiltrating files. Zscaler said it resembles the Go-based GITSHELLPAD implant from an earlier campaign, but adds encryption and new commands.

RUSTYMOVE handles the jump to isolated machines. It loops continuously, pausing two seconds between checks for external drives, and copies pre-staged malicious files onto any removable media it finds. One file Zscaler recovered was a shortcut named like a scanned PDF document that it assessed, with high confidence, launches RUSTYSHADE.

Two file stealers round out the kit: PSNATCH, a PowerShell script for Windows, and BASHNATCH for Linux. PSNATCH scans folders such as Desktop, Downloads, Documents and OneDrive for files modified within the last 120 days, with limits of 1GB per file and 5GB per run, and sends them to private GitHub repositories.

Office hours

The group also registered typosquatted domains impersonating popular Indian news outlets to stage PowerShell scripts, and hosted tools on legitimate cloud storage, including Backblaze. Most hands-on activity took place between Aug. 20 and Sept. 1. Every command Zscaler logged was issued between 4 a.m. and 11 a.m. UTC, and all of it on weekdays, with nothing during the two weekends in the analysis window.