Operation RusticWeb: Rust-Based Malware Targets Indian Government Entities

Operation RusticWeb is a multi-stage phishing campaign observed since October 2023 targeting Indian government and defense organizations; it delivers Rust-based payloads and encrypted PowerShell scripts to enumerate systems, collect files and system information, and exfiltrate data to a public file-sharing service (oshi.at/OshiUpload). Analysts note overlaps with Pakistan-linked APT clusters such as Transparent Tribe and SideCopy, and a related chain uses a Rust executable masquerading as "Cisco AnyConnect Web Helper"; the activity demonstrates targeted espionage-focused capabilities rather than broad destructive operations.