Reported by 2 outlets
APT36 Operation RapidRust Deploys RUSTYSHADE, RUSTYMOVE, and Other New Malware
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
APT36 Operation RapidRust Deploys RUSTYSHADE, RUSTYMOVE, and Other New Malware covers recent security developments. Key references include . The event content notes IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their ta. This matters because it affects systems users rely on. Watch for patches and confirmed exploitation updates.
Timeline
-
original reporting
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
malware.news · 27d ago · September 16th, 2026
IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. During our investigation, ThreatLabz discovered new malware families and post-compromise tools, as well as significant post-compromise activity. The new tools include the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.In this blog post, we provide a detailed technical analysis of APT36’s new tooling and post-compromise activity. Key TakeawaysIn August 2026, ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 targeting government and defense entities in India and Afghanistan.RUSTYSHADE is a new Rust-based backdoor that abuses attacker-controlled private GitHub repositories for command-and-control (C2) and uses AES-256-GCM to encrypt C2 communications.RUSTYMOVE is a new post-compromise tool used by APT36 to copy pre-staged malicious files to external removable media connected to infected machines, enabling the malware to spread to air-gapped networks.APT36 registered multiple typosquatted domains that impersonate popular Indian news outlets to stage malicious PowerShell
-
update from securityonline.info
Explore how the Operation RapidRust APT36 malware campaign by Zscaler ThreatLabz exposes new tools like RUSTYSHADE and RUSTYMOVE targeting g
securityonline.info · 21d ago · September 22nd, 2026
Explore how the Operation RapidRust APT36 malware campaign by Zscaler ThreatLabz exposes new tools like RUSTYSHADE and RUSTYMOVE targeting g
via Mastodon https://securityonline.info/operation-rapidrust-apt36-malware/?utm_source=mastodon&utm_medium=jetpack_social