Pakistan-Aligned Hackers Deploy New Rust Backdoor Against India and Afghanistan

ISLAMABAD — A cyber threat group linked to Pakistan, known as Transparent Tribe, has deployed a new malicious software tool targeting government and defense sectors in India and Afghanistan. The operation, identified on Sept. 18, 2026, involves the use of a Rust-based backdoor dubbed RUSTYSHADE, marking a significant shift in the group's technical capabilities.

The threat actor, also tracked under the aliases APT36 and Earth Karkaddan, utilized private repositories on the GitHub code-sharing platform to establish command-and-control communications for the malware. Security researchers identified that the group is leveraging these private channels to direct operations against high-value targets in South Asia with an elevated operational tempo.

RUSTYSHADE represents a departure from previous tools used by Transparent Tribe, which historically relied on more common programming languages. The adoption of Rust, a systems programming language known for its memory safety and performance, suggests an effort to evade detection by traditional security defenses that often struggle to analyze binaries compiled in newer environments. The malware is designed to maintain persistent access within compromised networks, allowing operators to exfiltrate data or execute further commands.

The campaign specifically focuses on ministries of defense, intelligence agencies, and critical infrastructure entities across India and Afghanistan. In recent months, the group has demonstrated a pattern of targeting diplomatic communications and military planning documents. The current deployment indicates an intensification of these activities, with multiple infections detected across both nations within a short timeframe.

Government officials in New Delhi and Kabul have not publicly commented on the specific nature of the RUSTYSHADE tool, though cybersecurity advisories issued by national CERTs in the region warn of increased phishing campaigns and supply chain compromises associated with state-aligned actors. The use of private GitHub repositories for command infrastructure highlights a growing trend among advanced persistent threats to utilize legitimate cloud services to mask malicious traffic.

The timing of the attack coincides with heightened geopolitical tensions in the region. Analysts note that the group's ability to rapidly deploy new tools suggests a well-resourced operation capable of adapting quickly to defensive measures. The specific objectives behind this latest wave of intrusions remain unclear, as no data breaches have been publicly attributed to RUSTYSHADE at this stage.

Questions remain regarding the full extent of the compromise and whether other government sectors beyond defense are affected. As investigators work to trace the command-and-control channels, the deployment of Rust-based malware signals a potential arms race in cyber capabilities between state-aligned groups and regional defenders. The situation continues to develop as security teams scramble to patch vulnerabilities exploited by the new backdoor.