Transparent Tribe

At a glance

Facts

• Pakistan-aligned threat group
• Maintains high operational tempo with updated TTPs

Activity timeline

Facts

• Fresh cyber attacks targeting government and defense entities in India and Afghanistan
• Long-running persistent threat group
• Significant portion of actions took place between August 20 and September 1, 2026
• C2 commands issued only between 4 a.m. and 11 a.m. UTC and only on weekdays

Attribution assessment

Facts

• RUSTYSHADE shares functionality overlap with GITSHELLPAD, a Golang implant observed in September 2025 in connection with Gopher Strike campaign

Initial access and identity targets

Facts

• Uses typosquatted domains impersonating Indian news organizations to host malicious PowerShell scripts and payloads

Capabilities and evasion

Facts

• Takes screenshots and webcam photos
• Performs file operations and runs background commands
• Recursive scanning of preconfigured directories for Microsoft Office documents, images, archives, media, executables, scripts, and databases modified within last three months
• File collection limited to 1 GB per file and 5 GB per execution
• USB propagation and removable media monitoring
• System, user, and network reconnaissance

Infrastructure patterns

Facts

• Uses private GitHub repositories for encrypted C2 communications
• Registers typosquatted domains: theprints.org (mimics theprint.in) and indiatodays.org (mimics indiatoday.in)
• Uses attacker-controlled GitHub gist for file stealers
• Uses private repository named after infected machine for exfiltration

Communication and pressure channels

Facts

• RUSTYSHADE parses and writes files in private GitHub repository for bidirectional communication using GitHub REST API
• Uses encrypted command and output files in GitHub repository

Named victims

Organizations

• government and defense entities in India
• government and defense entities in Afghanistan
• Afghan telecom providers
• South Asian critical infrastructure organizations

Reported detail

Facts

• Transparent Tribe deployed four previously undocumented malware tools (RUSTYSHADE, RUSTYMOVE, PSNATCH, BASHNATCH) in Operation RapidRust targeting Indian and Afghan government and defense entities
• RUSTYSHADE is a Rust-based backdoor using private GitHub repositories for encrypted C2 communications via GitHub REST API
• The group uses typosquatted domains impersonating Indian news organizations to host malicious payloads and PowerShell scripts
• RUSTYMOVE is a USB propagation tool that monitors for external removable media and copies malicious files to detected drives
• Post-compromise activity includes system and network reconnaissance with C2 commands limited to weekday business hours (4-11 a.m. UTC)