Operation RapidRust Turns Private GitHub Repositories Into an Espionage Control Channel

Transparent Tribe has deployed a new Rust-based backdoor and cross-platform file-stealing tools in attacks targeting government and defense organizations in India and Afghanistan.

The Pakistan-aligned threat group, also tracked as APT36 and Earth Karkaddan, uses attacker-controlled private GitHub repositories to exchange encrypted commands, collect reconnaissance data, and exfiltrate files. Typosquatted domains impersonating Indian news organizations support the campaign’s payload-delivery infrastructure.

Zscaler ThreatLabz named the activity Operation RapidRust and identified four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Together, they provide remote access, surveillance, document theft, and propagation through removable drives.

GitHub becomes the backdoor’s communications layer

RUSTYSHADE is a Rust implant that communicates through the GitHub REST API. Instead of connecting to a conventional command-and-control server, it reads and updates specific files inside a private repository controlled by the attackers.

Each file performs a defined operational role:

• command.txt carries encrypted instructions from the operator.
• results.txt receives encrypted output from executed commands.
• info.txt stores reconnaissance details about the infected system.
• heartbeat.txt acts as a keepalive signal.
• screenshot.png contains an encrypted desktop capture.
• webcam_photo.jpg contains an encrypted webcam image.
• download.bin holds encrypted data taken from selected files.

This arrangement creates a bidirectional control channel within legitimate cloud infrastructure. Security controls that permit GitHub traffic may therefore see requests to a trusted service rather than an obvious connection to an attacker-owned server.

Private repositories also limit outside visibility into the exchanged files. However, endpoint and network telemetry can still expose unusual GitHub API use, especially from systems, users, or processes that do not normally interact with software-development services.

RUSTYSHADE can run commands in the background, manipulate files, capture screenshots, and take webcam photographs. These capabilities give operators both remote administration and surveillance functions after initial access.

The architecture partially resembles GITSHELLPAD, a Golang implant observed in September 2025 during the Gopher Strike campaign. Both use repository files to maintain two-way communication, although no direct code relationship has been established.

Windows and Linux stealers search recent files

Operation RapidRust includes dedicated file-collection components for both major desktop operating-system families.

PSNATCH is a PowerShell stealer for Windows. It recursively examines predefined directories and looks for several categories of information, including:

• Microsoft Office documents
• Images and media files
• Compressed archives
• Executables and scripts
• Database files

The search prioritizes files modified within the previous three months. PSNATCH uploads collected material to a private repository whose name is based on the compromised computer.

The stealer applies two collection limits: no individual file can exceed 1 GB, and one execution can upload no more than 5 GB. These thresholds provide defenders with useful hunting parameters, although lower-volume transfers could be equally significant.

BASHNATCH performs an equivalent role on Linux using a Bash script. Its presence indicates that the campaign is not limited to Windows-heavy government environments and can collect data from Linux hosts encountered during an intrusion.

Following compromise, the operators conduct system, user, and network reconnaissance before introducing additional payloads. That sequence can help distinguish malicious GitHub traffic from legitimate development activity: discovery commands followed by script execution, new payloads, and private-repository access form a stronger signal than any event considered alone.

RUSTYMOVE extends infections through removable drives

The fourth tool, RUSTYMOVE, is a lightweight 64-bit Windows utility written in Rust. It is designed to spread prepared malicious files through removable storage.

RUSTYMOVE continuously checks for external drives by running a PowerShell script. When it detects one, the utility places two files in the device’s root directory:

• DriverInstaller.zip, which contains RUSTYSHADE
• DocScanner-11-Aug-2026-5-37pm.pdf.LNK

The .LNK file is believed to contain a command that launches RUSTYSHADE after extraction. Its filename uses a double-extension pattern intended to resemble a PDF document while remaining a Windows shortcut.

This propagation method can move the implant into networks where direct internet-based delivery is difficult or closely monitored. It also creates a risk for disconnected or restricted systems when personnel carry removable media between machines.

The available findings do not establish whether the copied files execute automatically. User interaction or another execution mechanism may still be required.

Typosquatted news domains support payload delivery

The attackers registered domains resembling prominent Indian media websites. Two identified examples are:

• theprints[.]org, impersonating The Print at theprint[.]in
• indiatodays[.]org, impersonating India Today at indiatoday[.]in

The deceptive domains hosted malicious PowerShell scripts and payloads. Their names could make links appear credible to targets accustomed to reading regional news, while minor spelling and top-level-domain changes separate them from the legitimate sites.

A GitHub gist was also used to deliver a file-stealing component. This extends the campaign’s abuse of GitHub beyond backdoor communications and into payload distribution.

A substantial portion of the observed activity occurred from August 20 through September 1, 2026. During that interval, command-and-control instructions appeared only on weekdays and between 4 a.m. and 11 a.m. UTC.

That schedule may assist retrospective investigations, but it should not become a rigid detection rule. Operators can alter working hours, automate activity, or resume the campaign under a different timetable.

The operation follows another campaign attributed to Transparent Tribe by the Acronis Threat Research Unit. That activity targeted Afghan telecommunications providers and critical-infrastructure organizations in South Asia using a backdoor called PATCHCORD. Operation RapidRust therefore fits a broader pattern of sustained intelligence collection against government, defense, telecommunications, and infrastructure targets in the region.

What defenders should hunt for

There is no vendor patch or remediation package for Operation RapidRust because the activity is not tied to a disclosed software vulnerability. No CVE identifiers, affected product versions, CVSS score, or formal severity rating have been reported.

Containment instead depends on endpoint monitoring, network controls, credential review, and removal of the malicious components. Defenders should prioritize the following actions:

1. Restrict unnecessary GitHub access. Monitor use of private repositories, gists, and the GitHub REST API from endpoints that have no documented business need for them.

2. Search for RUSTYSHADE repository artifacts. Investigate access involving command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, or download.bin, particularly when several appear in the same sequence.

3. Inspect script activity. Review PowerShell and Bash execution associated with recursive file searches, recent-file filtering, downloaded payloads, or repeated removable-drive checks.

4. Block and investigate the typosquatted domains. Any communication with theprints[.]org or indiatodays[.]org should be treated as suspicious and examined for payload retrieval.

5. Monitor removable media. Hunt for DriverInstaller.zip and DocScanner-11-Aug-2026-5-37pm.pdf.LNK appearing in the root directories of external drives.

6. Review unusual upload volumes. Transfers approaching 1 GB per file or 5 GB per execution merit scrutiny, particularly when directed through GitHub-related services.

7. Correlate reconnaissance with follow-on deployment. System enumeration, user discovery, and network inspection followed by new scripts or GitHub API connections may indicate an active compromise.

Affected organizations should also examine webcam access, screenshot creation, credential exposure, and data staging. Removing one payload may not be sufficient if the attackers have already established another persistence mechanism or obtained reusable credentials.

Operation RapidRust shows a toolset built around ordinary cloud services rather than conspicuous bespoke infrastructure. Detecting it requires attention to how trusted services are being used—not simply whether those services are allowed.