IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan.
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
About this summary. This is a short, independently written summary of an article first published by Zscaler ThreatLabz. Cyber Security News did not report or verify the underlying story. Read the original: https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and
Source attribution: headline and facts are from Zscaler ThreatLabz (zscaler.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 115
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Gray Rabbits and…
NightEagle targets Russian companies
Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (also tracked as APT-Q-95). This group…
Other users can watch your browsing and time your keystrokes through OS file notifications
Researchers at Graz University of Technology have used the file-notification systems in Windows, Linux, and macOS to spy on activity in other accounts. On Windows, a…
Crooks use fake desktop apps to fool HR staff into giving them remote access
You work in your company's human resources department and use HR software to check employee information, benefits, and payroll. So, when you see a downloadable Windows…
Chrome Dev for Desktop Update
The Dev channel has been updated to 156.0.8072.0 for Windows, Mac and Linux. A partial list of changes is available in the Git log. Interested in switching release…
Kothamine malware uses Tailscale’s tailcat to evade network detection
We discovered an undocumented remote-access Trojan (RAT) called Kothamine Agent. It supports more than 30 commands and it gives attackers control of an infected Windows…