[rustyshade]

September 20, 2026

• Transparent Tribe (APT36) is running "Operation RapidRust" against Indian and Afghan government and defence targets with four previously undocumented tools: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. Zscaler ThreatLabz notes RUSTYSHADE uses attacker-controlled private GitHub repos for encrypted C2, reading and writing command.txt, results.txt, heartbeat.txt and exfil blobs over the GitHub REST API — traffic that blends into normal developer noise. Delivery leans on typosquatted Indian news domains (theprints[.]org, indiatodays[.]org). The Hacker News · Threat Activity

in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks

September 17, 2026

• APT36 ran Operation RapidRust in August against government and defence targets in India and Afghanistan, with new malware families RUSTYSHADE, RUSTYMOVE, PSNATCH and BASHNATCH plus new post-compromise tooling. Zscaler ThreatLabz. · Threat Activity

in One Extension Hijacks the AI Assistant in Five Major Browsers