Transparent Tribe, a Pakistan-aligned advanced persistent threat group also tracked as APT36 and Earth Karkaddan, has deployed new malware tools targeting government and defense organizations in India and Afghanistan. Security researchers at Zscaler ThreatLabz attributed the campaign to the group and identified four previously undocumented malware variants used in the attacks.
The newly discovered tools include RUSTYSHADE and RUSTYMOVE, both written in Rust, alongside PSNATCH and BASHNATCH. The use of private GitHub repositories for command-and-control infrastructure distinguishes this campaign from Transparent Tribe's previous operations. GitHub's mainstream hosting service provides the threat group with legitimate-looking traffic patterns that blend with normal developer activity, complicating network detection.
Transparent Tribe maintains an extensive history targeting South Asian government agencies. The group has been active since at least 2013, focusing primarily on information theft and espionage operations. Previous campaigns relied on custom malware variants and spear-phishing tactics to penetrate government networks. This latest activity demonstrates the group's continued evolution in tradecraft and tool development.
The use of Rust for malware development represents a broader industry trend among sophisticated threat actors. Rust provides memory safety guarantees that reduce certain exploitation vectors while delivering performance comparable to C and C++. RUSTYSHADE and RUSTYMOVE specifically exploit this advantage, offering the group backdoor capabilities with reduced detection signatures compared to traditional malware written in older languages.
PSNATCH and BASHNATCH operate as credential harvesters and shell access tools respectively. These components enable attackers to extract authentication materials from compromised systems and maintain interactive command execution on infected hosts. The modular design suggests Transparent Tribe coordinates multiple attack phases, beginning with reconnaissance and credential acquisition before deploying persistence mechanisms.
Private GitHub repositories provide several operational security benefits to the threat group. Unlike traditional domain-based command-and-control infrastructure, GitHub-based C2 requires no domain registration or hosting infrastructure procurement. Repositories can be created, modified, and destroyed quickly. Traffic to GitHub repositories blends with legitimate software development activity, creating detection challenges for network monitoring solutions. GitHub's SSL encryption also obscures command traffic from network-level inspection tools.
The targeting scope reflects Transparent Tribe's strategic priorities. Government entities in India and Afghanistan represent high-value targets for signals intelligence and military capabilities. Defense organizations provide access to sensitive procurement data, operational plans, and personnel information valuable to Pakistani intelligence services. The group's persistence in targeting these sectors despite previous exposure indicates operational confidence and continued resource allocation from sponsoring organizations.
Zscaler ThreatLabz's detection represents incremental progress in understanding Transparent Tribe's current capabilities. The identification of specific tools enables defensive teams to develop detection signatures and network rules. However, the group's demonstrated ability to develop custom tools rapidly suggests new variants will emerge within months.
Organizations managing sensitive defense and government networks should prioritize hunting for RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH indicators across their infrastructure. Outbound connections to GitHub repositories should receive enhanced monitoring given legitimate development use cases. Credential-focused defenses, including multi-factor authentication and privileged access management, substantially increase operational costs for attackers attempting to pivot after initial compromise.