Transparent Tribe Uses GitHub for C2 in New Campaign
A Pakistan-aligned threat group has leveraged private GitHub repositories for command-and-control operations, targeting government and defense sectors in South Asia with new Rust-based malware.
Security researchers have identified a new cyber campaign attributed to Transparent Tribe, a threat group linked to Pakistan. According to Zscaler ThreatLabz, the actor has targeted government and defense entities in India and Afghanistan using a suite of previously undocumented tools. The operation, codenamed RapidRust, marks a significant evolution in the group’s tradecraft, specifically regarding the infrastructure used for remote control.
The campaign involves the deployment of RUSTYSHADE, a backdoor written in Rust that utilizes private GitHub repositories for encrypted communications. This approach allows the malware to exchange commands and exfiltrate data through a trusted code hosting platform, blending malicious traffic with legitimate developer activity. The group also employed typosquatted domains mimicking major Indian news outlets to distribute initial payloads, a tactic designed to bypass user suspicion.
GitHub Repositories Serve as Control Channels
The core of the new toolset, RUSTYSHADE, interacts with private GitHub repositories via the REST API to maintain bidirectional communication. The malware parses specific files within these repositories, such as command.txt for instructions and results.txt for output. This method facilitates the execution of tasks including desktop screenshot capture, webcam activation, and file exfiltration. The use of a widely respected platform for command-and-control represents a notable shift from traditional infrastructure, potentially complicating detection efforts for defenders monitoring standard C2 domains.
According to the report published by Zscaler, this technique shares functional similarities with GITSHELLPAD, a Golang implant observed in late 2025. By leveraging the GitHub API, the actor can maintain persistent access without relying on dedicated server infrastructure that might be more easily flagged by network security tools. This reliance on commercial cloud services for malicious purposes highlights the increasing convergence of standard development workflows and advanced persistent threat operations.
Lateral Movement and Data Theft Tools
Beyond the primary backdoor, the campaign includes RUSTYMOVE, a lightweight Windows utility designed for lateral movement via removable media. The tool monitors for USB drives and automatically copies malicious payloads, including a zip file containing the backdoor and a malicious shortcut file, to the root directory of detected drives. This mechanism facilitates the spread of the infection across isolated or air-gapped systems within a target network.
The group also deployed file-stealing programs named PSNATCH and BASHNATCH to target Windows and Linux environments, respectively. PSNATCH recursively scans directories for recent documents, executables, and databases, exfiltrating up to 5 gigabytes per execution to a private repository named after the infected host. These tools are fetched from attacker-controlled GitHub gists, further embedding the malicious activity within the GitHub ecosystem. The combination of these tools allows for comprehensive reconnaissance and data theft across diverse operating systems.
Implications for South Asian Cyber Security
This activity follows a previous campaign identified by Acronis Threat Research Unit that targeted Afghan telecom providers and critical infrastructure. The consistent focus on government and defense sectors in India and Afghanistan suggests a sustained strategic objective. The use of typosquatted domains impersonating reputable news organizations like The Print and India Today underscores the importance of email and web filtering in mitigating initial access vectors. Organizations in the region are advised to monitor for unusual GitHub API activity and review access controls on private repositories.
The forward question for defenders is how to distinguish legitimate developer activity from malicious C2 channels that exploit GitHub’s API. As threat actors continue to adopt commercial platforms for their operations, security teams must refine their detection logic to identify anomalous patterns in repository access and file operations. The convergence of development tools and cyber espionage infrastructure presents a persistent challenge for maintaining network integrity in the region.
