← threat actors
threat actor · PK
Operation C-Major
also tracked as apt36 5, transparent tribe 5, sidecopy 3
7 stories · 6 in the wild · June 17, 2026 – September 20, 2026
evidence: 6 observed · 1 demonstrated
how they got in
- phishing email 2 · Jun 18
- seo poisoning 1 · Sep 20
sectors
- defense 5 · Sep 20
- government 3 · Sep 20
- education 1 · Jul 2
geography
- india 7 · Sep 20
- afghanistan 3 · Sep 20
- pakistan 1 · Aug 23
malware and tools
- crimsonrat 3 · Sep 8
- bashnatch 2 · Sep 20
- psnatch 2 · Sep 20
- rustymove 2 · Sep 20
- rustyshade 2 · Sep 20
- deskrat 1 · Jul 2
- stealthserver 1 · Jul 2
techniques
- command and control 2 · Sep 20
- lnk files 1 · Sep 8
- powershell 1 · Sep 8
- execution 1 · Jun 18
- spear phishing 1 · Jun 18
- luring 1 · Jun 17
attack phases seen
- Initial access 5 · Sep 20
- Execution 5 · Sep 17
- Command and control 2 · Sep 20
what we reported, newest first, grouped by story
Aug 23 – September 20, 2026 · 3 reports
- Transparent Tribe (APT36) is running "Operation RapidRust" against Indian and Afghan government and defence targets with four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Zscaler ThreatLabz notes RUSTYSHADE uses attacker-controlled private GitHub repos for encrypted C2, reading and writing
command.txt, results.txt, heartbeat.txt and exfil blobs over the GitHub REST API — traffic that blends into normal developer noise. Delivery leans on typosquatted Indian news domains (theprints[.]org, indiatodays[.]org). The Hacker News
· Sep 20 · observed · via seo poisoning · as transparent tribe, apt36 · Threat Activity - APT36 ran Operation RapidRust in August against government and defence targets in India and Afghanistan, with new malware families RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH plus new post-compromise tooling. Zscaler ThreatLabz.
· Sep 17 · observed · as apt36 · Threat Activity
- Transparent Tribe has refreshed its toolset for operations against Afghan government targets, succeeding against less mature Taliban-run organisations while failing against better-defended Indian agencies (Dark Reading).
· Aug 23 · observed · as transparent tribe · Threat Activity
September 8, 2026
- SideCopy / Transparent Tribe activity against Indian defence targets continues with the same LNK plus BAT/PowerShell tradecraft. Qihoo 360's Advanced Threat Research Institute published further CrimsonRAT samples and a separate Go-based RAT, with infrastructure reuse across both campaigns (360 ATRI report).
· Sep 8 · observed · as sidecopy, transparent tribe · Threat Activity
July 2, 2026
- TransparentTribe (APT36) is weaponizing the 2026 Indian NEET exam-leak controversy as a lure, deploying the Go-based StealthServer backdoor (Windows counterpart of DeskRAT) with WebSocket C2. FalconFeeds.
· Jul 2 · demonstrated · as transparent tribe, apt36 · Threat Activity
Jun 17 – June 18, 2026 · 2 reports
- SideCopy (APT36 / Transparent Tribe) continues its double-extension LNK → PowerShell → CrimsonRAT chain against Indian defense, swapping lures between fake PowerPoint briefings and Word "Minutes of Meeting" docs; staged components barely register at delivery. IOCs via Nextron (Nextron).
· Jun 18 · observed · via phishing email · as sidecopy, apt36, transparent tribe · Threat Activity & Ransomware
- SideCopy / APT36 (Transparent Tribe) targeted Indian defense personnel with a weaponized PowerPoint package and a double-extension
.pptx.lnk shortcut launching a .NET CrimsonRAT loader. Nextron Research.
· Jun 17 · observed · via phishing email · as sidecopy, apt36 · Threat Activity