In August 2026, APT36 initiated Operation RapidRust targeting South Asian government and defense sectors. The campaign introduced RUSTYSHADE, a Rust-based backdoor utilizing private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools include RUSTYMOVE for USB-based lateral movement to air-gapped systems, PSNATCH and BASHNATCH for exfiltrating files from Windows and Linux hosts respectively. Attackers used typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities involved systematic network reconnaissance, credential harvesting, and lateral movement attempts. The operation was conducted exclusively on weekdays between 4:00-11:00 UTC, indicating strong operational security and sustained targeting of government infrastructure in India and Afghanistan.

The campaign enables persistent unauthorized access to sensitive government and defense networks in India and Afghanistan, facilitating data exfiltration and lateral movement, including into air-gapped environments. The use of encrypted command-and-control channels and custom tools complicates detection and response efforts. The targeting of critical infrastructure and use of operational security measures increase the risk of prolonged espionage and data compromise.

No official patches or fixes are applicable as this is a threat actor campaign using custom malware. Defenders should monitor for indicators of compromise such as the listed malicious hashes, typosquatted domains, and PowerShell script activity. Network segmentation, restricting USB device usage, and enhanced monitoring for unusual lateral movement and credential harvesting behaviors are recommended. Awareness of the attacker’s operational timing (weekdays 4:00-11:00 UTC) may assist in focused detection efforts.