Transparent Tribe Uses GitHub Repositories for Rust Backdoor C2

Pakistan-aligned threat group Transparent Tribe, also tracked as APT36 and Earth Karkaddan, has been linked to attacks on government and defense entities in India and Afghanistan using four previously undocumented tools. Zscaler ThreatLabz has named the activity Operation RapidRust and identified the malware families as RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH.

The campaign combines a Rust-based backdoor with private GitHub repositories for command-and-control communications, file stealers for Windows and Linux, and a removable-media propagation utility. Zscaler said a significant share of observed activity occurred between August 20 and September 1, 2026, with commands issued on weekdays between 4 a.m. and 11 a.m. UTC.

Private GitHub repositories used as C2 infrastructure

RUSTYSHADE is a Rust backdoor that uses attacker-controlled private GitHub repositories and the GitHub REST API for encrypted, bidirectional communication. Zscaler noted functionality overlap with GITSHELLPAD, a Golang implant associated with the Gopher Strike campaign observed in September 2025.

The implant reads and writes repository files assigned to particular tasks. These include command.txt for encrypted commands, results.txt for command output, info.txt for reconnaissance data and heartbeat.txt for keepalive beaconing. Other files hold encrypted screenshots, webcam captures and exfiltrated content.

Commands available to RUSTYSHADE allow operators to take screenshots, capture webcam photos, perform file operations and execute commands in the background. The group also registered typosquatted domains that imitate Indian news organizations, including theprints[.]org and indiatodays[.]org, to host malicious PowerShell scripts and payloads.

File theft and removable-media propagation

After compromise, operators retrieved file stealers from an attacker-controlled GitHub gist. PSNATCH is a PowerShell stealer for Windows that recursively searches configured directories for recently modified Office documents, images, archives, media, executables, scripts and databases. It collects files modified in the previous three months, with limits of 1 GB per file and 5 GB per execution, then exfiltrates them to a private repository named for the infected machine.

BASHNATCH provides similar collection capabilities for Linux systems. RUSTYMOVE, meanwhile, is a lightweight 64-bit Windows tool written in Rust that monitors for external removable media through a PowerShell script. When a drive is detected, it copies DriverInstaller.zip, containing RUSTYSHADE, and DocScanner-11-Aug-2026-5-37pm.pdf.LNK to the root directory. The shortcut is suspected of executing the backdoor after extraction.

What defenders should examine

Zscaler described post-compromise activity that includes system, user and network reconnaissance before deployment of next-stage payloads. The use of legitimate GitHub infrastructure for encrypted communications can make repository access part of the investigation surface, alongside endpoint activity and network indicators.

For security teams supporting relevant environments, the practical implication is to review unusual GitHub REST API use, access to private repositories, PowerShell-driven removable-media monitoring and lookalike domains, while correlating those signals with file collection, screenshot capture and webcam activity on endpoints.