Transparent Tribe (APT36) Rust Backdoor Campaign - Operation Using Private GitHub C2

Technical Analysis

The threat actor uses a mix of Rust-based backdoors (RUSTYSHADE, RUSTYMOVE) and credential-harvesting/execution tools (PSNATCH, BASHNATCH), suggesting cross-platform targeting of both Windows and Unix-like systems. Abuse of private GitHub repositories for C2 communication allows the malware to blend malicious traffic with legitimate developer and CI/CD activity, complicating network-based detection and enabling resilience against takedown efforts. This technique mirrors a broader trend of APT groups abusing trusted cloud and developer platforms to bypass egress filtering and reputation-based blocking. Organizations running AI agents or automated DevOps pipelines with GitHub integrations (e.g., agents that pull code, manage repos, or use GitHub API tokens) face risk if compromised credentials or tokens are harvested by PSNATCH/BASHNATCH, potentially enabling the attacker to pivot into agent-connected CI/CD systems or exfiltrate API keys used by autonomous coding or repo-management agents.

Affected Systems

Government and defense networks in India and Afghanistan; systems using GitHub for legitimate CI/CD or repository management; Windows and Unix/Linux endpoints (based on PowerShell/bash-named tooling)

Indicators of Compromise

• RUSTYSHADE (Rust backdoor)
• RUSTYMOVE (Rust backdoor)
• PSNATCH (PowerShell-based credential/data theft tool)
• BASHNATCH (Bash-based credential/data theft tool)
• Private GitHub repositories used for C2 (specific repo names/URLs not disclosed in source)

Remediation Steps

1. 1

   Monitor GitHub API traffic

   Inspect outbound connections to github.com and githubusercontent.com for anomalous patterns, especially from endpoints that should not normally interact with GitHub, and flag unusual API token usage.

2. 2

   Audit and rotate GitHub credentials/tokens

   Rotate personal access tokens, SSH keys, and OAuth credentials used by developers, CI/CD systems, and any AI agents with repository access; enforce short-lived tokens and least-privilege scopes.

3. 3

   Deploy endpoint detection for Rust and script-based malware

   Update EDR/AV signatures to detect RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH; hunt for suspicious Rust binaries and PowerShell/bash scripts with obfuscated network calls.

4. 4

   Restrict outbound access to code repositories

   Implement network egress controls limiting which hosts can reach GitHub or other code-hosting platforms, particularly on servers not involved in software development.

5. 5

   Enhance phishing and initial-access defenses

   Given Transparent Tribe's historical reliance on spear-phishing, reinforce email filtering, attachment sandboxing, and user awareness training for government and defense personnel.