[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9bBLXS7eizyRp7xiVGyod49WW4mtutNgCMXyV17vGCs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":63},"787b6108-4462-480e-8d59-22fb839dbcad","apt36-abuses-private-github-repos-for-stealthy-c2-communications","adb45b12-d847-4d4f-be3e-c84c383db61e","APT36 Abuses Private GitHub Repos for Stealthy C2 Communications","Transparent Tribe (APT36) is exploiting the inherent trust organizations place in legitimate platforms like GitHub by using private repositories as command-and-control infrastructure, effectively blending malicious traffic with normal developer activity. Typosquatted domains further weaponize user inattention to deliver novel Rust-based backdoors (RUSTYSHADE, RUSTYMOVE) and bash\u002FPowerShell stealers. This matters because traffic to trusted platforms like GitHub often bypasses traditional perimeter defenses and content inspection tools, giving attackers a persistent, low-visibility foothold. Organizations that lack granular egress filtering and behavioral monitoring of outbound connections to code-hosting platforms are particularly exposed to this technique.","**Immediate actions:**\n- Block or strictly control outbound connections to GitHub API endpoints from non-developer systems and servers using firewall or proxy allowlisting.\n- Deploy DNS filtering and threat intelligence feeds to detect and block typosquatted domains before payloads are delivered.\n- Hunt for indicators of compromise (IOCs) related to RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH across endpoints and network logs.\n\n**Detection measures:**\n- Enable deep packet inspection and TLS decryption on egress traffic to detect anomalous use of legitimate platforms (GitHub, Pastebin, etc.) for C2 beaconing.\n- Configure SIEM rules to alert on unusual processes making outbound HTTPS calls to code-hosting repositories, especially from government or defense workstations.\n- Monitor for execution of Rust-compiled binaries and unexpected shell scripting activity (bash\u002FPowerShell) on endpoints.\n\n**Long-term improvements:**\n- Implement strict application allowlisting to prevent unauthorized or unknown executables (including novel Rust binaries) from running on sensitive systems.\n- Enforce network segmentation so that government and defense endpoints have no direct internet access, routing all traffic through authenticated, inspected proxies.\n- Conduct regular threat-hunting exercises focused on living-off-trusted-sites (LOTS) techniques and APT TTPs mapped to MITRE ATT&CK for nation-state actors.",[12,13,14,15,16,17,18,19,20,21,22],"MITRE ATT&CK T1102.001 – Web Service: Dead Drop Resolver","MITRE ATT&CK T1583.001 – Acquire Infrastructure: Domains (Typosquatting)","MITRE ATT&CK T1059 – Command and Scripting Interpreter","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","CIS Control 4 – Secure Configuration of Enterprise Assets","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 AC-17 – Remote Access","NIST CSF DE.CM-1 – Network Monitoring","NIST CSF PR.AC-5 – Network Integrity \u002F Segmentation",{},"published","2026-09-18T16:20:45.443121+00:00","2026-09-18T16:20:45.316+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ftransparent-tribe-deploys-new-rust.html","transparent-tribe-deploys-new-rust-backdoor-using-private-github-repositories-fo-eb5aad","Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[51,57],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"e4ddf157-8a72-499f-ab71-e2da6f4258e8","2026-09-20","afternoon","ThreatNoir Weekend Brief — September 20","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-20\u002Fthreatnoir-afternoon-brief-2026-09-20.mp3",{"id":58,"date":59,"edition":60,"title":61,"audio_url":62},"720d8f46-1f79-4b3b-8389-af7d6c8e8bef","2026-09-19","morning","ThreatNoir Weekend Brief — September 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-19\u002Fthreatnoir-morning-brief-2026-09-19.mp3",[64,68,72],{"slug":65,"name":66,"problem":67},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":69,"name":70,"problem":71},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":73,"name":74,"problem":75},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]