APT36

Transparent Tribe Deploys New Rust-Based Backdoor in Targeted Campaigns Against Government and Defense Entities

The Pakistan-aligned threat group Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. According to Zscaler ThreatLabz, the attacks involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity leverages private GitHub repositories for command-and-control (C2) infrastructure. The operation highlights an evolution in the group's tooling, incorporating Rust-based backdoors to evade detection.