#ParsedReport #CompletenessHigh
16-09-2026

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and

Report completeness: High

Actors/Campaigns:
Transparenttribe

Threats:
Rustyshade
Rustymove_tool
Psnatch_tool
Bashnatch_tool
Typosquatting_technique
Gitshellpad
Gogitter

Victims:
Government, Defense

Industry:
Government

Geo:
Indian, Afghanistan, India, Pakistan

TTPs:
Tactics: 4
Technics: 0

IOCs:
Url: 9
File: 20
Path: 2
Command: 7
Domain: 3
Hash: 4

Soft:
Linux, Microsoft Office, curl, Microsoft OneDrive

Algorithms:
aes-256-gcm, zip, sha256, aes, base64

Functions:
Get-Volume, Get-Partition, Get-Disk, Write-Output, Write-Host

Win API:
BCryptGenRandom, CommonDialog, CreateProcessW, CopyFileExW, NetBIOS

Languages:
powershell, rust, golang