Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repos for C2

Transparent Tribe (APT36) is attributed with 'Operation RapidRust', a campaign targeting government and defense organizations in India and Afghanistan that uses a newly documented Rust backdoor, RUSTYSHADE, which performs C2 by reading/writing files in private GitHub repositories; the toolkit also includes USB-propagation (RUSTYMOVE) and file-stealers (PSNATCH, BASHNATCH), delivery via typosquatted domains, and specific indicators and mitigation guidance.