APT36 Uses USB Malware to Breach Air-Gapped Government Networks

Key Takeaways

• APT36, a state-sponsored threat group, is actively deploying USB-borne malware to infiltrate air-gapped government networks in India and Afghanistan.
• The “RapidRust” campaign utilizes a custom toolkit including the RUSTYMOVE USB-spreading utility, the RUSTYSHADE backdoor, and PSNATCH/BASHNATCH for data exfiltration.
• This sophisticated attack method bypasses traditional network security by physically transferring malware via infected removable media.
• The threat group leverages private GitHub repositories and cloud storage for command and control, as well as lookalike domains mimicking legitimate news outlets.
• Organizations, particularly those managing sensitive or air-gapped systems, must implement stringent controls over removable media and monitor for specific indicators of compromise.

APT36 Targets Air-Gapped Networks with USB Malware

A sophisticated campaign attributed to APT36, a threat actor with suspected ties to Pakistan, is exploiting removable media to penetrate government networks in India and Afghanistan that are physically isolated from the internet. Dubbed “RapidRust,” this operation employs a specialized suite of malware designed for backdoor access, extensive file exfiltration, and propagation via USB drives.

The strategic use of USB-spreading malware is particularly concerning as it directly addresses the challenge of breaching air-gapped environments. These networks are intentionally disconnected from external networks to safeguard highly sensitive systems and data. However, as demonstrated by this campaign and other incidents like the GoldenJackal attacks, a compromised USB drive can bridge this physical divide, introducing malware into otherwise secure systems.

Researchers at Zscaler first identified this activity in August 2026, subsequently attributing it to APT36. The group’s custom toolkit is capable of siphoning documents, mapping internal networks, and establishing a foothold within systems that lack internet connectivity.

Operation RapidRust: Blending In

Zscaler said in a report that the RapidRust campaign employs a blend of tactics to evade detection. These include utilizing private GitHub repositories for command and control, leveraging cloud-hosted payloads, and creating deceptive domains that imitate Indian media organizations. Such methods allow the threat actors to mask their malicious activities within typical web traffic, making detection more challenging for security teams.

The campaign underscores a critical vulnerability in controlled environments: even a seemingly innocuous propagation utility can introduce significant risk. This is especially pertinent for organizations handling classified information, where data often moves between administrative workstations and isolated operational systems. A single unvetted removable drive can severely compromise the intended security separation during routine data transfers.

USB-Spreading Malware: RUSTYMOVE

A central component of this attack phase is RUSTYMOVE, a lightweight Windows application developed in the Rust programming language. Once deployed on a compromised machine, RUSTYMOVE continuously monitors for the insertion of USB, SD, MMC, and IEEE 1394 removable devices, scanning for new media every two seconds.

Upon detecting a removable drive, RUSTYMOVE copies two pre-configured files to its root directory: a ZIP archive containing the RUSTYSHADE backdoor and a shortcut file disguised as a PDF document. Analysts are highly confident that executing this shortcut initiates the extraction and execution of the archived backdoor, effectively transforming the removable drive into a delivery mechanism for further infection.

RUSTYMOVE incorporates a mechanism to track a drive’s unique identifier, preventing redundant file copies. Its design, lacking an integrated network communication channel or a hidden payload, strongly suggests its primary function is to facilitate the spread of the attack. Similar USB-borne tactics have been observed in other campaigns, such as Mustang Panda’s SnakeDisk, reinforcing the notion that physical isolation alone is insufficient as a security measure.

To ensure persistence, APT36 configures a scheduled task named “StandAloneOneDriveUpdater-2626” to launch RUSTYMOVE at logon, masquerading as a legitimate system updater.

Backdoor and Data Exfiltration Capabilities

RUSTYMOVE operates in conjunction with RUSTYSHADE, a 64-bit Rust backdoor. RUSTYSHADE leverages attacker-controlled private GitHub repositories for receiving commands and exfiltrating stolen data. It employs encryption for its communications, enabling the operators to perform a range of malicious actions, including requesting directory listings, executing shell commands, capturing screenshots, taking webcam images, and uploading files.

The use of a legitimate development platform like GitHub as a command and control channel complicates monitoring efforts, particularly if organizations broadly whitelist GitHub traffic. This technique has been observed in other campaigns, such as those involving GitHub infrastructure abuse, highlighting the importance of scrutinizing API access to repositories.

For data theft, APT36 utilizes PSNATCH for Windows and BASHNATCH for Linux. These tools systematically search folders, removable drive letters, and recently accessed files before transmitting the collected data to private repositories. PSNATCH is designed to optimize data collection by filtering files based on size and tracking previously uploaded content, which minimizes redundant transfers in subsequent operations.

Post-initial access, the threat actors execute commands to enumerate users, processes, connected machines, shared resources, and reachable systems. They then proceed to test network services and attempt connections to remote administrative shares, indicating a clear intent to expand their presence beyond the initial compromise.

What You Should Do

• Restrict Removable Media: Implement strict policies on the use of USB drives and other removable media. Only allow approved, scanned, and whitelisted devices on sensitive systems.
• Endpoint Detection and Response (EDR): Deploy and configure EDR solutions to monitor for suspicious file creation, process execution, and scheduled tasks, particularly those originating from public-user directories.
• Network Segmentation: Reinforce network segmentation, especially for air-gapped systems, to limit lateral movement even if an initial compromise occurs.
• Monitor GitHub API Activity: Scrutinize all GitHub API usage and other cloud storage interactions within your network, treating any unusual activity with extreme suspicion.
• Threat Hunting: Actively hunt for the provided Indicators of Compromise (IoCs), including file hashes and suspicious domains/URLs. Investigate any unusual PowerShell activity or downloads from unexpected cloud storage locations.
• User Education: Train employees on the risks associated with untrusted removable media and the importance of reporting suspicious files or device behavior.
• Block Malicious Infrastructure: Immediately block the listed payload staging domains and URLs at your network perimeter.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.