Security1 publisher2 min readPublished
APT36 derives its AES key from the same GitHub token it ships inside the binary
Zscaler ThreatLabz traced August 2026 attacks on Indian and Afghan government and defense targets to a new Rust backdoor that takes orders from private GitHub repositories. Its encryption key is a hash of a token sitting in cleartext in the sample.
The Watch · Security desk
What happened
- Zscaler ThreatLabz reports August 2026 activity by the Pakistan-nexus actor APT36, tracked as Operation RapidRust, against government and defense organizations in India and Afghanistan.
- RUSTYSHADE, a 64-bit Windows backdoor written in Rust, takes its tasking from attacker-controlled private GitHub repositories through the GitHub REST API.
- PSNATCH scans preconfigured directories and sends files with matching extensions to the same private repositories, and BASHNATCH does the equivalent job on Linux.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure For a defense network that permits api.github.com, both the control path and the exfiltration path now terminate on an allowed hostname with an allowed TLS session and a valid token.
- capability The cleartext token gives incident responders decryption of captured C2 traffic and read-write access to the actor's own repository, which is unusual leverage from a single sample.
- constraint Domain and reputation blocking will not catch this traffic, so detection falls back to behaviour: which hosts have any business calling a developer API with a personal access token.
- precedent The move from Golang to Rust with encryption bolted on suggests the group is iterating its implants around a fixed hosting choice, so the next family should be expected on the same platform.
The key is a hash of the credential. RUSTYSHADE derives its 32-byte AES key from the SHA256 hash of the GitHub personal access token [9], and the token itself sits in the binary in cleartext [7]. A defender holding a sample therefore holds both the key that decrypts captured C2 messages and the credential that authenticates to the actor's repository [20].
The rest of the cryptography is ordinary. RUSTYSHADE generates a 12-byte nonce with BCryptGenRandom, encrypts with AES-256-GCM, and formats the result as nonce, then ciphertext, then a 16-byte authentication tag [10]. It base64-encodes that and prepends the string HCENC1: [11].
On the network the channel is a single hostname. The backdoor calls the GitHub REST API for repository contents with a branch reference and a timestamp parameter, authenticating with an Authorization: token header [6]. The repositories are private [5]. Tasking is a set of agreed filenames the malware reads and writes, and the same scheme carries beacons and exfiltrated data [12]. PSNATCH and BASHNATCH push stolen files to the same private repositories [15][16].
APT36 has used this pattern before. Zscaler says RUSTYSHADE resembles GITSHELLPAD from the GOGITTER campaign, with the differences being encrypted C2, new commands, and Rust in place of Golang [19]. The company's previous write-up on the group was published in January 2026, seven months before the August activity it now reports [3][21]. Two backdoors and two file stealers across those campaigns all point at private GitHub repositories [22].
Delivery is cheap. One observed install ran powershell wget against a Backblaze B2 URL to pull DriverInstaller.zip [13]. The group also registered typosquatted domains impersonating popular Indian news outlets to stage PowerShell scripts and payloads [17]. Inside the network it looked for live hosts and mapped shares [18], and RUSTYMOVE copied pre-staged malicious files onto removable media connected to infected machines; Zscaler describes that as the route into air-gapped networks [14].
The detection surface the report supports is narrow. Every C2 message begins with HCENC1: [11], and the traffic is token-authenticated requests to api.github.com contents endpoints from hosts that have no reason to touch a developer API [24]. Revoking the hardcoded token ends that build's access to the repository, because the same secret authenticates the session [23].
What to watch
- Whether GitHub revokes the tokens and removes the private repositories behind Operation RapidRust, and how quickly APT36 reissues them.
- Whether the next RUSTYSHADE build separates the C2 credential from the encryption key, which would remove the defender's decryption shortcut.
- Whether PSNATCH or BASHNATCH turn up against targets outside India and Afghanistan.