Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Transparent Tribe uses new Rust malware and GitHub for C2 in attacks on India and Afghanistan.
The Pakistan-aligned threat group Transparent Tribe (APT36) is targeting government and defense entities in India and Afghanistan with new tools like RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Notably, the group is leveraging private GitHub repositories for command-and-control (C2) communications and using typosquatted domains to distribute malicious payloads.
AI summary of the linked source. Not reviewed by an editor. How this works
Run RUSTYSHADE?
Get an email when a new story names RUSTYSHADE, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTransparent Tribe (APT36) is exploiting the inherent trust organizations place in legitimate platforms like GitHub by using private repositories as command-and-control infrastructure, effectively blending malicious traffic with normal developer activity. Typosquatted domains further weaponize user inattention to deliver novel Rust-based backdoors (RUSTYSHADE, RUSTYMOVE) and bash/PowerShell stealers. This matters because traffic to trusted platforms like GitHub often bypasses traditional perimeter defenses and content inspection tools, giving attackers a persistent, low-visibility foothold. Organizations that lack granular egress filtering and behavioral monitoring of outbound connections to code-hosting platforms are particularly exposed to this technique.
What helps against this
How we list vendors
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — theprints[.]org
- domain — indiatodays[.]org
- mitre_attack — T1071.001
- mitre_attack — T1041
- mitre_attack — T1573.002
- mitre_attack — T1048
- mitre_attack — T1071
- mitre_attack — T1059.001
- mitre_attack — T1059.004
- mitre_attack — T1021.001
- mitre_attack — T1135
- mitre_attack — T1005
- mitre_attack — T1027
- mitre_attack — T1105
- mitre_attack — T1571
- mitre_attack — T1071.004
- mitre_attack — T1566.002
- mitre_attack — T1204.002
- mitre_attack — T1071.002
- mitre_attack — T1219