Operation RapidRust: New APT36 Malware Tools

This ThreatLabz technical analysis describes Operation RapidRust attributed to APT36, which uses a Rust backdoor (RUSTYSHADE) that leverages attacker-controlled private GitHub repositories and AES-256-GCM encryption for C2, PowerShell/Bash stealers (PSNATCH/BASHNATCH) for broad file exfiltration to per-host GitHub repos, and a USB propagation tool (RUSTYMOVE); the report includes command lists, filenames, persistence methods, and observed post-compromise activity occurring on weekdays between 04:00–11:00 UTC.