Full Report
The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation
Analysis Summary
# Threat Actor: Transparent Tribe
## Attribution & Identity
* **Actor Name:** Transparent Tribe
* **Aliases:** APT36, Earth Karkaddan
* **Associations:** Pakistan-aligned threat group.
## Activity Summary
* **Operation Name:** Operation RapidRust (discovered September 2026).
* **Timeline:** Significant activity observed between August 20 and September 1, 2026.
* **Recent History:** Previously linked to "Operation Gopher Strike" (September 2025) and campaigns utilizing the PATCHCORD backdoor (August 2026).
* **Operational Patterns:** C2 commands are typically issued only on weekdays between 4 a.m. and 11 a.m. UTC, suggesting a structured, professional work schedule.
## Tactics, Techniques & Procedures
* **Living off Trusted Services:** Exploitation of private GitHub repositories and GitHub Gists for command-and-control (C2) and payload delivery via the GitHub REST API.
* **Typosquatting:** Registration of domains mimicking legitimate Indian news outlets to host malicious scripts.
* **Lateral Movement:** Use of USB propagation tools to spread via removable media.
* **Reconnaissance:** Automated scripts for system, user, and network reconnaissance post-compromise.
* **Data Exfiltration:** Automated file stealing based on file extensions, modification dates (last 3 months), and size limits (1 GB per file/5 GB per execution).
* **Multi-Platform Targeting:** Development of malware in Rust and Go for cross-platform compatibility (Windows and Linux).
## Targeting
* **Sectors:** Government, Defense, Telecommunications, and Critical Infrastructure.
* **Geography:** Primarily India and Afghanistan; general South Asia region.
* **Victims:** Government and defense entities; Afghan telecom providers.
## Tools & Infrastructure
* **Malware Families:**
* **RUSTYSHADE:** A Rust-based backdoor using GitHub for encrypted C2.
* **RUSTYMOVE:** A 64-bit Windows USB propagation tool.
* **PSNATCH:** A PowerShell-based file stealer targeting Windows.
* **BASHNATCH:** A Bash-based file stealer targeting Linux.
* **PATCHCORD:** A previously observed backdoor.
* **GITSHELLPAD:** A Golang implant with functional overlaps to RUSTYSHADE.
* **Infrastructure:**
* theprints[.]org (Typosquat of *theprint[.]in*)
* indiatodays[.]org (Typosquat of *indiatoday[.]in*)
* Private GitHub Repositories (C2 infrastructure)
* GitHub Gists (Payload hosting)
## Implications
Transparent Tribe continues to demonstrate a high operational tempo and an increasing level of sophistication by adopting memory-safe languages like Rust to evade traditional signature-based detection. Their shift toward using legitimate cloud services like GitHub for C2 makes traffic blending easier, complicating efforts to distinguish malicious activity from legitimate developer traffic. The group remains a persistent threat to regional stability in South Asia.
## Mitigations
* **Cloud Service Monitoring:** Audit and monitor network traffic to GitHub APIs, especially involving private repositories or unconventional patterns from non-developer workstations.
* **Host-Based Security:** Implement EDR solutions to detect unauthorized PowerShell execution and suspicious USB device activity/mounting.
* **Domain Filtering:** Block known typosquatted domains and implement strict DNS filtering for newly registered domains (NRDs).
* **Removable Media Policy:** Restrict the use of USB drives or enforce mandatory scanning and "no-autorun" policies across government and defense networks.
* **Data Loss Prevention (DLP):** Configure DLP tools to flag or block large-scale recursive file copying/exfiltration of Office documents and databases to external web services.