Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

Transparent Tribe, a threat group linked to Pakistan, has launched a new wave of cyber attacks targeting government and defense entities in India and Afghanistan. The group is using previously undocumented tools, including a Rust backdoor, to carry out these attacks. The tools used in the attacks are referred to as RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Private GitHub repositories are being utilized for command and control purposes. The attacks have been codenamed Operation by researchers. Zscaler ThreatLabz has attributed the attacks to Transparent Tribe, also known as APT36 and Earth Karkaddan.