Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation

Report facts: Zscaler ThreatLabz attributes new cyber attacks on government and defense entities in India and Afghanistan to the Pakistan‑aligned group Transparent Tribe, using previously undocumented Rust‑based backdoors (RUSTYSHADE, RUSTYMOVE) and tools like PSNATCH and BASHNATCH, with private GitHub repositories leveraged as command‑and‑control infrastructure. RealGround analysis: While the campaign targets traditional IT systems rather than AI models directly, it highlights supply chain risk from dependencies on third‑party code hosting and development platforms that may be abused for covert C2 and tooling distribution. Organizations building or operating AI systems that rely on open‑source code, GitHub‑hosted components, or shared developer infrastructure should strengthen SBOM practices, repository monitoring, and endpoint hardening to prevent similar compromise paths from propagating into AI pipelines and agent environments.