GitHub as command-and-control

APT36 derives its AES key from the same GitHub token it ships inside the binary

Zscaler ThreatLabz traced August 2026 attacks on Indian and Afghan government and defense targets to a new Rust backdoor that takes orders from private GitHub repositories. Its encryption key is a hash of a token sitting in cleartext in the sample.