APT36, a threat group widely linked to Pakistan, has been observed deploying a malware campaign that leverages infected removable media to infiltrate isolated government environments. The operation, dubbed RapidRust, primarily targets organizations in India and Afghanistan through a combination of backdoors, data-stealing tools, and USB-propagation malware.
The campaign highlights a persistent challenge facing highly secured environments. Although air-gapped networks are intentionally disconnected from the internet to protect sensitive assets, removable media can effectively bridge that gap when transferred between compromised and isolated systems. As a result, even tightly controlled environments remain vulnerable when trusted devices carry malicious code across security boundaries.
Security researchers at Zscaler identified the activity in August 2026 and attributed it to APT36. Their analysis revealed a toolkit capable of harvesting documents, mapping local networks, and extending infections into systems with no direct internet connectivity.
According to information shared with Cyber Security News, the attackers combined private GitHub repositories, cloud-hosted payloads, and spoofed domains resembling legitimate Indian news organizations. These tactics help malicious activity blend in with normal web traffic while reducing the likelihood of detection.
The campaign demonstrates how a relatively simple USB-spreading utility can create significant risk in environments designed to be isolated. In organizations where sensitive information regularly moves between administrative and operational networks, a single compromised removable drive can undermine carefully implemented security controls.
USB Propagation Powered by RUSTYMOVE
A central component of the campaign is RUSTYMOVE, a lightweight malware utility developed in the Rust programming language. After installation on a compromised Windows system, the tool continuously monitors for newly connected removable media, including USB drives, SD cards, MMC devices, and IEEE 1394 storage devices.
When a new device is detected, RUSTYMOVE automatically copies two files to the root directory:
- An archive containing the RUSTYSHADE backdoor.
- A shortcut file disguised as a legitimate PDF document.
Researchers believe with high confidence that opening the PDF-like shortcut triggers extraction and execution of the hidden backdoor, effectively transforming the removable drive into a malware delivery mechanism.
To avoid unnecessary duplication, RUSTYMOVE records a unique identifier for each device it infects. The tool contains no command-and-control capabilities or independent payloads, indicating its sole purpose is malware propagation.
The technique mirrors USB-based infection methods used in other advanced campaigns, reinforcing the reality that physical network isolation alone cannot guarantee protection against determined adversaries.
APT36 also configured a scheduled Windows task named StandAloneOneDriveUpdater-2626, designed to launch RUSTYMOVE automatically at user logon while disguising it as a legitimate software update process.
Recommended Defensive Measures
Organizations handling sensitive information should:
- Restrict the use of removable media.
- Permit only approved and scanned storage devices.
- Investigate unexpected shortcut files and archives.
- Monitor for suspicious scheduled tasks.
- Enforce strict media-handling policies for isolated networks.
RUSTYSHADE Backdoor and Data Exfiltration Capabilities
The USB-spreading component operates alongside RUSTYSHADE, a 64-bit Rust-based backdoor that communicates with attacker-controlled private GitHub repositories.
The malware encrypts communications and enables operators to:
- Browse directories.
- Execute shell commands.
- Capture screenshots.
- Access attached webcams.
- Upload and download files.
Using GitHub as a command-and-control platform can complicate security monitoring because many organizations regard GitHub traffic as legitimate developer activity. This abuse of trusted services allows attackers to hide within normal business operations.
PSNATCH and BASHNATCH Data Theft Tools
APT36 supplemented the backdoor with two custom information-stealing utilities:
- PSNATCH for Windows systems.
- BASHNATCH for Linux environments.
These tools search local directories, removable drives, and recently accessed files before transferring collected information to private repositories controlled by the attackers.
PSNATCH includes mechanisms to track previously stolen files and enforce file-size limits, reducing redundant uploads and enabling more efficient exfiltration during follow-on operations.
Lateral Movement and Network Reconnaissance
Following initial access, the threat actors conducted extensive reconnaissance activities to identify:
- Logged-in users.
- Running processes.
- Connected systems.
- Shared network resources.
- Reachable hosts.
Researchers observed attempts to enumerate network services and connect to administrative shares, indicating that the attackers intended to expand beyond the initially compromised machine and move laterally across the environment.
Key Takeaways for Defenders
The RapidRust campaign illustrates how sophisticated threat actors continue to bypass traditional network isolation strategies through removable media abuse and trusted cloud services.
Security teams should:
- Block known malicious domains and URLs.
- Hunt for RUSTYMOVE, RUSTYSHADE, PSNATCH, and BASHNATCH artifacts.
- Review unusual PowerShell activity.
- Monitor GitHub API interactions for suspicious behavior.
- Investigate unexpected cloud-storage downloads.
- Strengthen network segmentation.
- Enforce rigorous removable-media controls.
For government, defense, and critical infrastructure organizations that rely on air-gapped systems, maintaining strict oversight of removable devices remains one of the most effective ways to prevent malware from crossing otherwise secure network boundaries.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
