[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f87Uy1mFZRune1YJADQmdTu6bJbJAE3Byr13v97L-dlA":3},{"article":4,"iocs":52,"watch_terms":115,"solutions":116,"lesson":211},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"adb45b12-d847-4d4f-be3e-c84c383db61e","Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2","transparent-tribe-deploys-new-rust-backdoor-using-private-github-repositories-fo-eb5aad","The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation","The Pakistan-aligned threat group Transparent Tribe (APT36) is targeting government and defense entities in India and Afghanistan with new tools like RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Notably, the group is leveraging private GitHub repositories for command-and-control (C2) communications and using typosquatted domains to distribute malicious payloads.","Transparent Tribe uses new Rust malware and GitHub for C2 in attacks on India and Afghanistan.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftransparent-tribe-deploys-new-rust.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjhBM0nXgCLpwEyXmAdxLO_GatYww1Cem0yuGGqhmMwCB5N8w-TeoMm7jV4SbH4hjfYmxctUjyPiSlR3Caj2cSu7L_1nxTzg5xtfJrxhq5y0elL7yh8J2S5lakpnTbck3XhMVB1iG3obibSh64E8z877YcECkeJBs_rrZARXefKDeYQJ9Nf2u8pnxD0gEnx\u002Fs1600\u002Frust-malware.jpg","2026-09-18T15:24:16+00:00","2026-09-18T16:00:06.901423+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Transparent Tribe","threat_actor",{"name":21,"type":19},"APT36",{"name":23,"type":19},"Earth Karkaddan",{"name":25,"type":26},"RUSTYSHADE","product",{"name":28,"type":26},"RUSTYMOVE",{"name":30,"type":26},"PSNATCH","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[53,57,60,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112],{"type":54,"value":55,"context":56},"domain","theprints[.]org","Typosquatted domain impersonating The Print for C2\u002Fpayload hosting.",{"type":54,"value":58,"context":59},"indiatodays[.]org","Typosquatted domain impersonating India Today for C2\u002Fpayload hosting.",{"type":61,"value":62,"context":63},"mitre_attack","T1071.001","Application Layer Protocol: Web Protocols (GitHub API usage for C2)",{"type":61,"value":65,"context":66},"T1041","Exfiltration Over C2 Channel (GitHub repositories for C2)",{"type":61,"value":68,"context":69},"T1573.002","Encrypted Channel: Asymmetric Cryptography (Used in RUSTYSHADE C2)",{"type":61,"value":71,"context":72},"T1048","Exfiltration Over Alternative Protocol (GitHub REST API)",{"type":61,"value":74,"context":75},"T1071","Application Layer Protocol (GitHub API)",{"type":61,"value":77,"context":78},"T1059.001","Command and Scripting Interpreter: PowerShell (PSNATCH)",{"type":61,"value":80,"context":81},"T1059.004","Command and Scripting Interpreter: Unix Shell (BASHNATCH)",{"type":61,"value":83,"context":84},"T1021.001","Remote System Discovery (Implied by lateral movement and reconnaissance)",{"type":61,"value":86,"context":87},"T1135","Network Share Discovery (Implied by lateral movement and file exfiltration)",{"type":61,"value":89,"context":90},"T1005","Data from Local System (PSNATCH file exfiltration)",{"type":61,"value":92,"context":93},"T1027","Obfuscated Files or Information (Implied by encrypted C2)",{"type":61,"value":95,"context":96},"T1105","Ingress Tool Transfer (Fetching file stealers from GitHub gist)",{"type":61,"value":98,"context":99},"T1571","Non-Standard Port (Implied by GitHub API usage)",{"type":61,"value":101,"context":102},"T1071.004","Application Layer Protocol: DNS (Implied by domain usage)",{"type":61,"value":104,"context":105},"T1566.002","Phishing: Spearphishing Attachment (Implied by malicious scripts\u002Fpayloads)",{"type":61,"value":107,"context":108},"T1204.002","User Execution: Malicious File (Implied by LNK file execution)",{"type":61,"value":110,"context":111},"T1071.002","Application Layer Protocol: HTTP\u002FS (GitHub REST API)",{"type":61,"value":113,"context":114},"T1219","Remote Access Software (RUSTYSHADE backdoor functionality)",[25,28,30],{"controls":117,"vendors":204},[118,146,175],{"slug":35,"name":119,"problem":120,"products":121},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":147,"name":148,"problem":149,"products":150},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[151,159,167],{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":168,"vendor_name":169,"vendor_logo":170,"product_slug":171,"product_name":172,"url":173,"description":174},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"slug":176,"name":177,"problem":178,"products":179},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[180,188,196],{"vendor_slug":181,"vendor_name":182,"vendor_logo":183,"product_slug":184,"product_name":185,"url":186,"description":187},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":189,"vendor_name":190,"vendor_logo":191,"product_slug":192,"product_name":193,"url":194,"description":195},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":197,"vendor_name":198,"vendor_logo":199,"product_slug":200,"product_name":201,"url":202,"description":203},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[205],{"slug":206,"name":207,"logo_path":208,"roles":209},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png",[210],"reported_by",{"slug":212,"title":213,"body":214,"framework_refs":215,"framework_notes":227},"apt36-abuses-private-github-repos-for-stealthy-c2-communications","APT36 Abuses Private GitHub Repos for Stealthy C2 Communications","Transparent Tribe (APT36) is exploiting the inherent trust organizations place in legitimate platforms like GitHub by using private repositories as command-and-control infrastructure, effectively blending malicious traffic with normal developer activity. Typosquatted domains further weaponize user inattention to deliver novel Rust-based backdoors (RUSTYSHADE, RUSTYMOVE) and bash\u002FPowerShell stealers. This matters because traffic to trusted platforms like GitHub often bypasses traditional perimeter defenses and content inspection tools, giving attackers a persistent, low-visibility foothold. Organizations that lack granular egress filtering and behavioral monitoring of outbound connections to code-hosting platforms are particularly exposed to this technique.",[216,217,218,219,220,221,222,223,224,225,226],"MITRE ATT&CK T1102.001 – Web Service: Dead Drop Resolver","MITRE ATT&CK T1583.001 – Acquire Infrastructure: Domains (Typosquatting)","MITRE ATT&CK T1059 – Command and Scripting Interpreter","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AC-17 – Remote Access","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.AC-5 – Network Integrity \u002F Segmentation",{}]