A new cyber threat group, linked to Pakistan, has initiated a campaign targeting government and defense institutions in India and Afghanistan. The operation, dubbed Operation RapidRust, was discovered by Zscaler ThreatLabz in August 2026 and demonstrates the threat actor's continued evolution in malware development and post-compromise tactics. The campaign utilizes several newly identified tools, including the RUSTYSHADE backdoor, RUSTYMOVE USB propagation malware, and PSNATCH and BASHNATCH file stealers.
It employs a combination of cloud services, fake news domains, PowerShell scripts, removable media, and scheduled tasks to maintain access and steal sensitive information. This threat actor, known for targeting Indian government entities in previous campaigns, has maintained a high level of activity since January 2026.
The group focuses on intelligence gathering, moving through internal networks, and accessing systems without direct internet access. It leverages attacker-controlled private GitHub repositories as its command-and-control channel, enabling operators to send commands and retrieve stolen data via the GitHub REST API. APT36 operators can use RUSTYSHADE to gather system information, list files and drives, run commands, capture screenshots, take webcam photos, and download selected files.
A Linux variant named BASHNATCH performs similar collection activity and maintains a local record of previously uploaded files to support incremental data theft. APT36 also used typosquatted domains impersonating popular Indian media websites, including theprints[. ]org and indiatodays[. ]org.
