Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, the Pakistan-nexus threat actor APT36 launched Operation RapidRust, targeting government and defense organizations in India and Afghanistan with an updated arsenal of custom tools. The campaign introduced RUSTYSHADE, a Rust-based backdoor leveraging private GitHub repositories for command-and-control with AES-256-GCM encryption. Additional tools included RUSTYMOVE for USB-based lateral movement to air-gapped networks, PSNATCH and BASHNATCH for file exfiltration from Windows and Linux systems respectively. The attackers registered typosquatted domains impersonating Indian news outlets to stage malicious PowerShell scripts. Post-compromise activities revealed systematic network reconnaissance, credential harvesting, and lateral movement attempts, with operations conducted exclusively on weekdays between 4:00-11:00 UTC, demonstrating disciplined operational security and sustained targeting of South Asian government infrastructure.

• APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1Malware2026-01-26
• Twitter Feed - nextronresearch - 17-06-2026Malware2026-06-18
• Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, AfghanistanMalware2026-05-29
• New year, new sector: Targeting India's startup ecosystemMalware2026-02-04
• Sindoor Dropper: New Phishing CampaignMalware2025-09-02