Transparent Tribe Deploys New Rust-Based Backdoor in Targeted Campaigns Against Government and Defense Entities

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. Per Zscaler ThreatLabz, the attacks involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been observed leveraging private GitHub repositories for command-and-control (C2) infrastructure, a notable shift in operational security for the group. The newly documented tools include RUSTYSHADE, identified as a Rust-based backdoor; RUSTYMOVE, a Rust-based data exfiltration and lateral movement tool; PSNATCH, a PowerShell-based credential harvesting tool; and BASHNATCH, a Bash-based tool for maintaining persistence. Zscaler researchers noted that the use of private GitHub repositories as C2 infrastructure allows the threat actors to blend malicious traffic with legitimate developer activity, complicating detection efforts. The full scope of the campaign and specific victim counts have not been disclosed. Zscaler has shared indicators of compromise and detection guidance with the security community. As of reporting, no specific software patches have been issued, as the exploitation leverages custom tooling rather than known vulnerabilities in off-the-shelf products.