Actor Profile

Transparent Tribe (also tracked as APT36, Earth Karkaddan, COPPER FIELDSTONE, Mythic Leopard, and ProjectM) is a Pakistan-aligned advanced persistent threat group with sustained focus on South Asian geopolitical targets. The group demonstrates high operational tempo and continuous TTP evolution, historically deploying commodity RATs (DarkComet, njRAT, Crimson, ObliqueRAT) and custom tooling. In this campaign, codenamed Operation RapidRust, the actor has pivoted to Rust-based malware families (RUSTYSHADE, RUSTYMOVE) alongside PowerShell and Bash file stealers (PSNATCH, BASHNATCH), indicating investment in cross-platform capabilities and operational security through encrypted GitHub-based C2 channels.

TTPs (Tactics, Techniques, Procedures)

Initial access via spearphishing (T1566.001, T1566.002) and drive-by compromise (T1189), leveraging user execution (T1204.001, T1204.002) and exploitation for client execution (T1203). Infrastructure includes typosquatted domains (T1583.001, T1584.001) mimicking Indian news outlets (theprints[.]org, indiatodays[.]org) and private GitHub repositories for C2 (T1568). Malware obfuscation via encrypted payloads (T1027.013) and masquerading (T1036.005). Post-compromise: Visual Basic/PowerShell scripting (T1059.005) for reconnaissance and file exfiltration, USB propagation via RUSTYMOVE for lateral movement, and hidden files/directories (T1564.001). RUSTYSHADE backdoor enables screenshot capture, webcam access, file operations, and command execution via GitHub REST API. Operational pattern: weekday activity 04:00-11:00 UTC (August 20 - September 1, 2026).

Targets & Patterns

Primary targets are government and defense sector entities in India and Afghanistan, consistent with Pakistan-aligned strategic intelligence collection priorities. The use of typosquatted domains impersonating major Indian news organizations (The Print, India Today) suggests social engineering lures tailored to Indian government personnel and defense officials who regularly consume domestic news. Previous reporting (Acronis TRU) indicates expansion to Afghan telecom providers and South Asian critical infrastructure, reflecting broader regional espionage objectives. The deployment of both Windows and Linux file stealers (PSNATCH, BASHNATCH) indicates targeting of heterogeneous enterprise environments typical of government networks. USB propagation capability (RUSTYMOVE) suggests intent to bridge air-gapped or segmented networks common in defense installations.

Historical Context

Transparent Tribe maintains continuity with prior campaigns while demonstrating tactical evolution. The group's historical reliance on commodity RATs (DarkComet, njRAT, Crimson, ObliqueRAT, Peppy) has expanded to include custom Rust tooling, following the September 2025 Gopher Strike campaign which introduced GITSHELLPAD, a Golang GitHub-based backdoor with functional overlap to RUSTYSHADE. The August 2026 PATCHCORD campaign (reported by Acronis TRU) targeted Afghan telecom and South Asian critical infrastructure, indicating sustained operational tempo. The shift to Rust development and private GitHub C2 represents OPSEC maturation, likely in response to increased detection of legacy toolsets. The typosquatting of Indian news domains builds on established social engineering tradecraft while the USB propagation tool (RUSTYMOVE) introduces new lateral movement capabilities not previously documented for this actor.

Defensive Recommendations

  • Monitor GitHub API traffic for unusual patterns, particularly authenticated requests to private repositories from internal hosts; baseline legitimate developer activity and alert on deviations (T1568)
  • Detect PowerShell execution of file enumeration and archiving operations via Sysmon Event ID 1 and 4104 (script block logging); flag recursive directory scans with file size filters matching PSNATCH parameters (1GB/file, 5GB/execution) (T1059.005)
  • Implement USB device control policies and monitor for autorun.inf creation or LNK file drops to removable media root directories; alert on files matching RUSTYMOVE naming conventions (DriverInstaller.zip, DocScanner-*.LNK)
  • Block or sinkhole typosquatted domains mimicking trusted news organizations; deploy homograph detection for domain registrations similar to high-value brands in your region (T1583.001, T1584.001)
  • Hunt for Rust-compiled binaries (PE metadata, string artifacts) performing GitHub REST API calls to command.txt, results.txt, heartbeat.txt, screenshot.png, webcam_photo.jpg, download.bin; correlate with outbound HTTPS to api.github.com
  • Restrict spearphishing attachment execution by enforcing application whitelisting and disabling macros in Office documents from untrusted sources; monitor for user execution of LNK files with suspicious command-line arguments (T1204.002, T1566.001)

---

# Geopolitical Context

Geopolitical Context

The campaign attributed to Transparent Tribe (APT36, Earth Karkaddan) reflects enduring intelligence collection priorities consistent with Pakistan's strategic interests in South Asia. Targeting government and defense entities in India and Afghanistan aligns with long-standing regional tensions, particularly India-Pakistan rivalry and Pakistan's security concerns regarding Afghan border dynamics. The operational tempo—sustained attacks between August and September 2026 with disciplined weekday-only C2 activity—suggests a well-resourced, professionally managed operation. The use of typosquatted domains mimicking prominent Indian media outlets (The Print, India Today) indicates sophisticated social engineering tailored to regional information consumption patterns. This activity occurs within a broader context of persistent cyber espionage between nuclear-armed neighbors, where intelligence gathering on defense posture, policy deliberations, and military capabilities remains a strategic imperative.

State Actor Alignment

Transparent Tribe is widely assessed by the cybersecurity research community to be aligned with Pakistani state interests, though formal attribution to specific government entities remains unconfirmed in open sources. The group's consistent targeting of Indian government and defense sectors, alongside Afghan entities of strategic interest to Islamabad, is consistent with intelligence collection priorities that would serve Pakistani national security objectives. The operational discipline observed—including restricted C2 communication windows (weekdays, 4-11 a.m. UTC) and high operational tempo—suggests institutional support and tasking structures typical of state-sponsored or state-adjacent threat actors. Pakistan has not publicly acknowledged links to APT36, and Islamabad routinely denies sponsorship of cyber operations against India. No new sanctions or formal government attributions have been announced in connection with Operation RapidRust as of the reporting date.

Business Impacty pro region

The campaign's primary impact is concentrated in South Asia, where it may degrade the confidentiality of sensitive government communications and defense planning in India and Afghanistan. For India, persistent intrusions into defense and government networks complicate operational security and may inform Pakistani strategic calculations during periods of bilateral tension. Afghan targeting suggests continued Pakistani intelligence interest in post-withdrawal governance, security arrangements, and potential threats emanating from Afghan territory. The use of GitHub infrastructure for C2 and the development of cross-platform (Windows/Linux) tooling demonstrates APT36's technical maturation, potentially raising the barrier for detection by regional defenders with limited resources. While the immediate impact is regional, the campaign underscores broader challenges for platform providers (GitHub) in preventing abuse of legitimate services for malicious C2, and highlights the diffusion of advanced development languages (Rust) into the APT ecosystem. European and NATO stakeholders may view this activity through the lens of alliance partner (India) security and the broader stability of South Asian nuclear dynamics.

Forecast

If APT36 maintains its current operational tempo and continues iterating tooling (as evidenced by the shift from Golang to Rust-based implants), defenders in India and Afghanistan are likely to face sustained intrusion attempts requiring enhanced detection capabilities for GitHub-based C2 and Rust malware families. Should geopolitical tensions between India and Pakistan escalate—whether over Kashmir, cross-border incidents, or regional proxy competition in Afghanistan—APT36 activity may intensify in scope or aggression, potentially expanding to include disruptive or destructive capabilities beyond espionage. If GitHub and similar platforms implement stricter controls on private repository abuse for C2, APT36 may pivot to alternative infrastructure, though the group's demonstrated adaptability suggests rapid adjustment to defensive countermeasures. Increased information sharing between Indian, Afghan, and Western cybersecurity entities could improve collective defense, though political sensitivities and trust deficits may limit cooperation. Absent significant diplomatic breakthroughs or credible deterrence mechanisms, Pakistan-India cyber espionage is likely to remain a persistent feature of the regional security landscape.