The operators behind a fresh wave of espionage intrusions kept office hours. Command timestamps recovered by Zscaler ThreatLabz show activity only between 4:00 a.m. and 11:00 a.m. UTC, on weekdays, and nothing across either weekend. The crew is APT36, the Pakistan-nexus group that has worked government and defence targets in India and Afghanistan for years.
What is new is the tooling. In a campaign it calls Operation RapidRust, ThreatLabz found APT36 running a new Rust backdoor named RUSTYSHADE, two file-stealing scripts, and a small program built to carry the infection onto removable drives. Most of the observed activity ran from 20 August to 1 September 2026.
A backdoor that takes orders from a private repo
RUSTYSHADE is a 64-bit Windows backdoor with no server of its own. It authenticates to GitHub using a personal access token hardcoded in cleartext inside the binary, then reads and writes files in an attacker-controlled private repository: command.txt for tasking, results.txt for output, heartbeat.txt to show it is alive, and screenshot.png, webcam_photo.jpg and download.bin for stolen material. Every message is encrypted with AES-256-GCM under a key derived from the token. To anything watching the network, it is a machine talking to GitHub. The commands it accepts are mundane and effective: run a process, capture the screen or webcam, upload any file on disk.
Stolen files leave the way the malware arrived
Bulk collection is done by PSNATCH, a PowerShell script pulled from an attacker-controlled GitHub gist. It walks Desktop, Downloads, Documents, both OneDrive folders and drives D: through H:, takes anything modified in the last 120 days with an interesting extension, and pushes it into a private GitHub repository named after the infected machine. A tracking file at %APPDATA%\SmartUploader\uploaded_files.json means later runs upload only what changed. BASHNATCH is the same idea written as a Bash script, for Linux hosts.
The component aimed at networks with no internet
RUSTYMOVE is the piece defence networks should read twice, a small Rust program that loops every two seconds looking for removable media, USB, SD, MMC or FireWire, and copies two pre-staged files to the root of any drive it finds: a ZIP archive containing RUSTYSHADE, and a shortcut named DocScanner-11-Aug-2026-5-37pm.pdf.LNK. ThreatLabz assesses with high confidence that the shortcut launches the backdoor when clicked. Zscaler notes the tool relies on hardcoded paths and carries no payload of its own, which suggests early development, but its purpose is plain: reach machines the network cannot.
The payloads hid behind Indian news brands
The group registered typosquatted domains through NameCheap impersonating well-known Indian media: theprints[.]org against theprint.in in May 2026, and indiatodays[.]org against indiatoday.in in August. Those hosted intermediate PowerShell scripts and later-stage payloads, while the heavier archives sat on Backblaze storage. Follow-on activity was methodical rather than clever: subnet ping sweeps, SMB share enumeration, geolocation checks against public IP APIs, an attempt on a remote IPC$ share using administrator credentials, and a clean-up pass.
Where to look on your own estate
There is no patch here, because there is no single bug. Hunt the artifacts instead. Scheduled tasks masquerading as Microsoft updaters are the loudest, particularly StandAloneOneDriveUpdater-2626, used to launch RUSTYMOVE at logon. Then the tracking file at %APPDATA%\SmartUploader\uploaded_files.json, or its Linux twin under ~/.local/share/SmartUploader/, and outbound GitHub API requests carrying the custom user agent SmartUploader. Block the staging domains, and treat GitHub API traffic from a server with no development role as worth a second look.
Indicators
Staging domains: theprints[.]org, indiatodays[.]org, officialinfo[.]org. Payloads: hxxps://f005[.]backblazeb2[.]com/file/Clients-easy/DriverInstaller[.]zip and hxxps://clients-easy[.]s3[.]us-east-005[.]backblazeb2[.]com/Automata-20[.]zip. RUSTYSHADE: 80fdde0dafa450ae33937ccef752b46666da567926b2f39b37e02e77f9d6a92e. RUSTYMOVE: 70fc6cba3c2021889fb4093d0221dc6925818666df25718a630c562cac18da31.
The full analysis, with the complete C2 command table, is in Sudeep Singh's report for Zscaler ThreatLabz. We track the group on our Transparent Tribe profile, and the GitHub-as-command-channel trick is not its alone: we covered another Rust backdoor taking orders from GitHub last month. Wider context sits on our India country page.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.