21 SEP 2026 — A Rust backdoor aimed at government and defence targets in India and Afghanistan skips dedicated command servers. It logs in to GitHub with a token baked into the binary, reads orders from a private repository, and writes its answers back to the same place.
Zscaler's ThreatLabz team published the analysis on 16 September, naming the campaign Operation RapidRust and attributing it to the Pakistan-aligned group tracked as Transparent Tribe, APT36 or Earth Karkaddan.
GitHub as a command channel
RUSTYSHADE is a 64-bit Windows backdoor written in Rust. Its command and control runs over the GitHub REST API against repositories the operators own and have set to private, with traffic encrypted using AES-256-GCM on top of the transport.
The appeal is that the traffic looks like development work. A network that legitimately uses GitHub cannot block connections to it on destination alone, so a channel that would stand out pointed at an unfamiliar host blends in when pointed at a service the organisation already trusts.
Once installed, the implant accepts commands that include taking screenshots and capturing a photograph from the webcam, alongside further operations on the host.
The credential in the binary
Authentication uses a hardcoded GitHub personal access token. That is an operational decision that cuts two ways.
It makes the implant self-contained, with no separate credential delivery. It also means the operators' access token travels inside every copy of the malware, so anyone who obtains a sample obtains the token. GitHub is in a position to revoke that token and to see what it reached.
The office-hours fingerprint
The schedule is the detail that matters most. A significant portion of activity fell between 20 August and 1 September 2026, and across that period the operators issued commands only between 04:00 and 11:00 UTC. All of it landed on weekdays, with nothing observed across either weekend.
Seven hours a day, five days a week, is a shift. Converted to Pakistan Standard Time at UTC plus five, that window runs from 09:00 to 16:00, a working day, but that is our arithmetic rather than a claim in the report.
Behavioural evidence of this kind is softer than a code artefact and harder to fake casually. An operator can strip language strings from a binary; keeping to a false schedule for a fortnight costs real inconvenience, because it means working nights to look like somebody else.
The rest of the toolkit
Three further tools appeared alongside the backdoor, none previously documented. RUSTYMOVE is a Rust utility for spreading over removable media: it watches continuously for external drives and copies pre-staged malicious files onto them, which is how a campaign reaches machines that are not on the network it started from.
PSNATCH is a PowerShell file stealer that collects files from an infected machine and exfiltrates them. BASHNATCH is the same capability for Linux. Building both versions suggests the target estate is not uniformly Windows.
Post-compromise, the operators ran system, user and network reconnaissance before deploying further payloads. This is the ordinary sequence, but it was directly observed here rather than assumed.
Who was targeted
Government and defence organisations in India and Afghanistan. Sudeep Singh, senior manager of APT research at Zscaler ThreatLabz, said the group "has maintained a high operational tempo and updated their tactics, techniques, and procedures" in continued attacks against those targets.
The published analysis does not detail the initial access vector; it concentrates on what happened after a foothold existed rather than how it was obtained. That is a material gap for a defender trying to work out whether the first step would have worked against them.
What defenders can key on
Destination-based detection fails here by design, so the useful signals sit elsewhere. Authenticated GitHub API activity from a host with no developer on it is anomalous however normal the destination looks. A process watching for removable media insertion on a machine with no reason to care is likewise anomalous.
The schedule is usable too, with caution. A command channel that only speaks during a fixed seven-hour window is a pattern, and a baseline can hold a pattern, provided nobody mistakes quiet weekends for the absence of an implant.
View author profile → · Editorial policy
