Before anything else: the targets here are government and defence organisations in India and Afghanistan. If that does not describe you, this campaign is not aimed at you and we are not going to pretend otherwise.
What is worth your time is the delivery channel, because it is the fourth variation on the same idea we have covered this month.
RUSTYSHADE talks to GitHub
Zscaler ThreatLabz documented the campaign, which it tracks as Operation RapidRust, attributing it to the Pakistan-nexus group APT36 — also known as Transparent Tribe and Earth Karkaddan.
The central payload, RUSTYSHADE, is a 64-bit Windows backdoor written in Rust. Its command-and-control channel is a set of attacker-controlled private GitHub repositories, accessed through the GitHub REST API, with communications encrypted using AES-256-GCM.
Operators and implant exchange data by reading and writing files in the repository:
command.txt encrypted commands from the operator results.txt encrypted command output info.txt system reconnaissance data heartbeat.txt keepalive beacon confirming an active infection screenshot.png encrypted desktop screenshot webcam_photo.jpg encrypted webcam capture download.bin encrypted exfiltrated file contents
The commands available include screenshots, webcam capture, file operations and background command execution.
The file stealers — PSNATCH for Windows, BASHNATCH for Linux — exfiltrate to the same place, often creating a separate private repository named after each infected machine. PSNATCH scans Desktop, Downloads, Documents, OneDrive and local drives for documents, archives, images, media, scripts, databases and executables modified in the last three months, capped at one gigabyte per file and five gigabytes per run. Payloads were also staged on Backblaze.
Why this channel works
You cannot block github.com. In any organisation with developers it is allowlisted, reputationally spotless, and carries constant legitimate TLS traffic. The same is true of Backblaze.
Attackers are not hiding their traffic. They are sending it somewhere you have already decided not to look.
This is the fourth time in a month we have written about the same principle from a different angle. An implant shaping its command traffic as Network Time Protocol on UDP 123, because nobody inspects NTP egress. A phishing platform using residential proxies matched to the victim's country so authentication signals see nothing unusual. A scanning campaign running from Google Cloud address ranges, which nobody blocks wholesale. And now the GitHub REST API.
Destination reputation is not a security control, and it has not been one for a while. What remains useful is not where traffic goes but who is sending it and how regularly.
Which gives you something to work with:
GitHub API traffic from machines with no reason to produce it. A finance workstation, an HR laptop or a domain controller talking to api.github.com is anomalous in a way that requires no threat intelligence to notice. You cannot block the domain across the estate. You can decide which population needs it, and the answer is not everyone.
Regularity. The heartbeat.txt file exists to prove the infection is alive, which means fixed-interval beaconing. Human developers do not produce evenly spaced API calls around the clock.
The operators keep office hours
ThreatLabz observed that C2 commands were issued only between 04:00 and 11:00 UTC, and only on weekdays. A significant share of post-compromise activity fell between 20 August and 1 September.
That is a disciplined operation on a shift pattern. It is also a warning about a common detection heuristic: "activity outside business hours" would not have flagged any of this, because it happened during someone's business hours — just not the victim's.
The transferable version is that the useful signal is consistency, not timing. A narrow, repeating window is machine-like whatever the clock says.
Bridging into air-gapped networks
RUSTYMOVE is a small Rust utility whose only job is to wait for removable media. It continuously watches for USB, SD, MMC and IEEE 1394 drives, and on each new one it drops two files in the root directory:
DriverInstaller.zip contains RUSTYSHADE DocScanner-11-Aug-2026-5-37pm.pdf.LNK shortcut that executes it
Look at that second filename. Windows hides the .LNK extension by default, so it displays as DocScanner-11-Aug-2026-5-37pm.pdf — a scanned document with a plausible timestamp, sitting in the root of a drive somebody just plugged in.
The countermeasure takes thirty seconds and applies to every Windows machine in existence: turn on file extension display in File Explorer. The trick stops working immediately.
The reason RUSTYMOVE exists at all is that the interesting networks in this target set are segmented or air-gapped. USB is the bridge, and it still works in 2026 because it relies on a person, not a vulnerability.
What is actually worth doing
- Decide who needs
api.github.com. Then alert on anyone outside that group reaching it. This is a policy question with a technical implementation, and it is the single highest-value item here. - Look for fixed-interval outbound traffic to trusted platforms. GitHub, Backblaze, Dropbox, cloud storage in general. Regularity is the tell, not the destination.
- Turn on file extension display, by policy, across the estate. It costs nothing and it defeats an entire family of lures.
- Have a position on removable media. Blocking it is not always possible. Knowing which machines accept it, and alerting on executable content written to the root of a removable drive, usually is.
- Check scheduled tasks as a persistence location. The post-compromise activity in this campaign used them, as most do.
One closing note on attribution
Zscaler links RUSTYSHADE to GITSHELLPAD, a Golang implant the same group used in September 2025. The tooling was rewritten in Rust; the tradecraft is the same.
That is the pattern worth keeping in view. Groups like this do not reinvent themselves — they port. The language changes, the channel stays, and the detection that worked on the behaviour keeps working when the detection built on the binary stops.
4Tify reviews egress policy and detection coverage, including the trusted destinations that no one inspects. If you want yours assessed, get in touch.