State-Backed Hackers Use Private GitHub Repos for New Backdoor

Security researchers have identified a fresh wave of cyber attacks attributed to Transparent Tribe, a threat group also known as APT36 or Earth Karkaddan. The campaign, labeled Operation RapidRust, targets government ministries and defense organizations in India and Afghanistan. According to The Hacker News, the group is using previously undocumented tools to maintain persistent access to these critical networks.

The operation relies on four distinct malware families: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. A significant shift in their methodology is the use of private GitHub repositories for command-and-control communications. Instead of traditional dedicated servers, the attackers leverage the popular code-hosting platform to send instructions and receive data, making their activities harder to distinguish from legitimate developer traffic.

Hiding commands in public code platforms

The core component, RUSTYSHADE, is a backdoor written in the Rust programming language. It connects to private GitHub repositories that only the attackers can access. By using the GitHub REST API, the malware reads and writes specific text files to exchange encrypted commands and results. This approach allows the group to bypass some network monitoring systems that might flag unusual traffic to known malicious IP addresses.

The system functions as a two-way communication channel. Attackers place encrypted instructions in a file named command.txt. The infected machine reads these orders, executes them, and stores the output in a results.txt file. Additional files are used to maintain a heartbeat, confirming the infection is active, and to upload reconnaissance data such as system information, desktop screenshots, and webcam captures. This method effectively turns a collaboration tool into a covert control center.

Stealing data and spreading via USB drives

Once inside a network, the group deploys file-stealing tools to exfiltrate sensitive information. PSNATCH is a PowerShell script designed for Windows systems, while BASHNATCH serves the same purpose on Linux machines. These scripts recursively scan directories for valuable data, including Office documents, images, archives, and databases modified within the last three months. The stolen files are then uploaded to a private GitHub repository named after the infected machine.

To expand their presence, the attackers use a tool called RUSTYMOVE to propagate the infection through USB drives. This lightweight utility monitors for removable media connected to the victim’s computer. When a USB drive is detected, it copies a malicious zip file and a disguised PDF shortcut to the drive’s root directory. If another user opens the shortcut, the RUSTYSHADE backdoor is extracted and executed, creating a new foothold in the network.

Impersonating news outlets to lure victims

To deliver the initial malware, the group has registered typosquatted domains that mimic popular Indian news organizations. Domains such as theprints[.]org and indiatodays[.]org are used to host malicious PowerShell scripts and payloads. These look-alike sites are designed to trick officials into downloading and executing harmful code under the guise of reading news or accessing public information. This social engineering tactic lowers the barrier for initial compromise.

The trade-off for using GitHub repositories is that the attackers rely on a third-party service for their core operations. While this provides a legitimate-looking cover, it also means their infrastructure is tied to a platform that could potentially detect abnormal API usage patterns. Despite this, the group has maintained a high operational tempo, continuously updating their tactics to target critical infrastructure and government bodies in the region. The use of private repositories marks a sophisticated adaptation to modern cloud services.