APT36 Launches Operation RapidRust with New Rust Malware Tools

• •APT36 is targeting Indian and Afghan government and defense sectors.
• •New malware tools include RUSTYSHADE backdoor and RUSTYMOVE propagation tool.
• •Malware exfiltrates data via private GitHub repositories.

In August 2026, the Pakistan-nexus threat actor APT36 initiated Operation RapidRust, targeting government and defense organizations in India and Afghanistan. The campaign introduced several new Rust-based malware tools, including the RUSTYSHADE backdoor and RUSTYMOVE propagation tool. APT36 also deployed file-stealing scripts named PSNATCH and BASHNATCH, which exfiltrate data through private GitHub repositories. The RUSTYSHADE backdoor utilizes the GitHub REST API for command-and-control communications and employs a hardcoded Personal Access Token (PAT) for authentication. The group has been observed attempting lateral movement within networks and spreading malware via removable media to reach air-gapped environments. Security professionals are advised to monitor GitHub API usage and implement strict controls on removable media to mitigate risks. The campaign is ongoing, with significant post-compromise activity reported.