APT36 Uses GitHub Repos as Stealth C2

Command-and-control infrastructure is supposed to be the part of an intrusion that defenders can hunt: a server, a domain, a beacon pattern. Transparent Tribe has spent part of 2026 pushing that traffic somewhere most networks already trust. Zscaler ThreatLabz says the Pakistan-aligned group built a Rust backdoor that reads and writes its orders inside private GitHub repositories — activity it has labeled Operation RapidRust.

The targets described in the report are familiar ones for the group: government and defense entities in India and Afghanistan. What is new is the tooling — four previously undocumented families that split the work of intrusion, lateral movement, and file theft across Windows and Linux systems.

Security teams that block or alarm on unknown outbound hosts will not see a thing. GitHub is not an unknown host.

A backdoor that lives in a repo

RUSTYSHADE is the implant at the center of the campaign. It is written in Rust and uses attacker-controlled private GitHub repositories as its C2 channel, relying on the GitHub REST API to pass encrypted messages back and forth. According to Zscaler ThreatLabz, the malware parses and writes specific files inside the repository to move data in both directions.

The file names serve as a rough map of the implant's capabilities. The list includes command.txt for encrypted C2 commands, results.txt for encrypted command output, info.txt for system reconnaissance data, and heartbeat.txt for keepalive beaconing. Three more filenames cover data collection: screenshot.png for an encrypted desktop screenshot, webcam_photo.jpg for an encrypted webcam capture, and download.bin for encrypted exfiltrated file contents.

That feature set gives the backdoor the ability to take screenshots, capture a webcam photo, perform file operations, and run commands in the background. The researchers note that RUSTYSHADE overlaps in function with GITSHELLPAD, a Golang implant seen in September 2025 during a campaign tracked as Gopher Strike. The reuse of the pattern — a repository as a covert channel — appears deliberate rather than accidental.

Two stealers for two operating systems

Post-compromise activity includes fetching a file stealer from an attacker-controlled GitHub gist. Zscaler ThreatLabz identified two variants, one for Windows and one for Linux, and they are not symmetrical in how they work.

PSNATCH is a PowerShell stealer. It recursively scans preconfigured directories for Microsoft Office documents, images, archives, media, executables, scripts, and databases that were modified within the last three months, then exfiltrates what it finds to a private repository named after the infected machine. The collection is capped at 1 GB per file and 5 GB per execution, which gives the operator a predictable ceiling for each run.

BASHNATCH is a bash script that performs a similar job on Linux systems. Its existence matters because Transparent Tribe has previously concentrated on Windows endpoints; a Linux-capable stealer widens the range of hosts that can be harvested after initial access.

Spreading through USB drives

The most unusual tool in the set is RUSTYMOVE, a lightweight 64-bit Windows USB propagation utility also developed in Rust. Its job is to wait for removable media to appear. A PowerShell script continuously monitors for external drives, and when one is detected, the tool copies two pre-staged files to the root directory of that drive.

The first file is DriverInstaller.zip, which contains RUSTYSHADE. The second is DocScanner-11-Aug-2026-5-37pm.pdf.LNK, a shortcut that Zscaler ThreatLabz suspects contains a command to execute RUSTYSHADE after extraction. The naming and the PDF-shaped extension point at social engineering aimed at a user who plugs a found or shared drive into a machine and opens what looks like a scanned document.

USB propagation is old tradecraft, but pairing it with a Rust implant and a GitHub-based C2 channel is not. The drive itself becomes the delivery vehicle; the repository becomes the operator's console.

Typosquatted news domains

The campaign is not limited to repository abuse. Zscaler ThreatLabz says the actor registered typosquatted domains impersonating popular Indian news organizations to host malicious PowerShell scripts and payloads. Two domains are named in the report:

• theprints[.]org, which mimics The Print, whose legitimate domain is theprint[.]in
• indiatodays[.]org, which mimics India Today, whose legitimate domain is indiatoday[.]in

The choice of news brands fits the target set. Government and defense employees in India are plausible readers of those outlets, and a domain that differs from the real one by a single character is easy to miss in a link sent through email or chat.

Working hours of an intrusion

Zscaler ThreatLabz traced a significant portion of the post-compromise actions to a window between August 20 and September 1, 2026. Within that period, C2 commands were issued only between 4 a.m. and 11 a.m. UTC and only on weekdays.

That schedule is a constraint worth noting for defenders. It narrows the hours in which a live operator is likely to be interacting with an implant, and it suggests the activity is being run by people working a defined shift rather than an automated system that fires around the clock. Operators also performed system, user, and network reconnaissance before deploying next-stage payloads.

The group behind the tooling

Transparent Tribe is tracked under several names — APT36 and Earth Karkaddan among them — and is described as Pakistan-aligned. The group has a long-running focus on Indian and Afghan government and defense organizations, and the new campaign continues that pattern with updated tools.

"APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan," said Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz, in the technical report.

"This campaign demonstrates that APT36 continues to target government and defense entities in India and Afghanistan while maintaining high operational tempo and evolving TTPs."

— Sudeep Singh, senior manager of APT Research at Zscaler ThreatLabz

The report arrives a little over a month after Acronis Threat Research Unit tied the same threat group to a separate campaign aimed at Afghan telecom providers and South Asian critical infrastructure organizations. That operation used a backdoor called PATCHCORD, which suggests the group has been running more than one intrusion set in parallel.

The numbers behind RapidRust

• Four newly identified malware families: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
• Two typosquatted domains: theprints[.]org and indiatodays[.]org
• 1 GB per file limit on PSNATCH collection
• 5 GB per execution limit on PSNATCH collection
• Three months — the age window for files PSNATCH scans and takes
• August 20 to September 1, 2026 — the period covering a significant portion of post-compromise actions
• 4 a.m. to 11 a.m. UTC, weekdays only — the window in which C2 commands were issued

Why repository C2 is hard to catch

Most enterprise networks allow traffic to GitHub because developers depend on it. A backdoor that speaks through the GitHub REST API looks like that traffic, and the commands it retrieves are encrypted before they are written into the repository. There is no obvious beacon to an unfamiliar IP address, no domain generated by an algorithm, and no server that blocks or sinks when a defender reports it.

The same logic applies to the gist used to deliver the file stealers. A gist is a normal part of GitHub's surface area, and pulling a file from one is a routine action. Organizations that monitor egress will need to look at what is being requested from code-hosting services, not just whether the service is reachable.

RUSTYMOVE adds a second problem that has nothing to do with the network. A USB drive that carries DriverInstaller.zip and a shortcut disguised as a scanned PDF can cross an air gap or move between a home machine and an office one. That path does not depend on the victim opening a phishing email or visiting a typosquatted news site.

The typosquatted domains do depend on the victim. Their success rests on a reader clicking a link that looks close enough to a real Indian news outlet. Defenders can use the two domains named in the report as concrete indicators, but the broader lesson is that brand-adjacent domains aimed at a specific country's readership are a low-cost way to reach the same government and defense employees the group already targets.

What this means for defenders

The practical consequence of Operation RapidRust is that the C2 channel may already be inside the list of destinations an organization permits. Blocking GitHub outright is not a realistic option for most software teams, but alerting on repository and gist access from hosts that have no business making those calls is a narrower and more workable step. So is watching for the specific filenames RUSTYSHADE uses, since command.txt, results.txt, info.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, and download.bin appearing in repository activity tied to an endpoint is not normal developer behavior.

The USB component suggests another check that costs little: policy and technical controls on removable media, and awareness that a file named like a scanned PDF is not always a scanned PDF. The shortcut DocScanner-11-Aug-2026-5-37pm.pdf.LNK is the kind of artifact that a user would have to open for the chain to continue.

For government and defense organizations in India and Afghanistan, the report points to a group that has not slowed down and is willing to rebuild its toolset. The shift toward private repositories as infrastructure means the detection work belongs as much to network and endpoint teams watching code-hosting traffic as it does to analysts chasing malware hashes. Zscaler ThreatLabz's findings are currently the account of a single research team, and independent confirmation of the campaign's scope is not yet available — but the indicators it published give defenders something concrete to search for while that picture develops.