APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks

APT36, a Pakistan-linked threat group, has launched a campaign that uses infected removable drives to carry malware into disconnected government environments.

The operation, called RapidRust, targets India and Afghanistan with a backdoor, file stealers, and a USB-spreading tool. This approach is important because air-gapped networks are separated from the internet to protect sensitive systems.

A USB drive can still bridge that physical divide when it moves between an infected computer and a restricted one, a risk also illustrated by reports on GoldenJackal air-gap attacks.

Analysts at Zscaler identified the activity in August 2026 and attributed it to APT36. The toolkit can steal documents, survey local networks, and reach systems without internet connectivity.

Zscaler said in a report shared with Cyber Security News (CSN) that the campaign blends private GitHub repositories, cloud-hosted payloads, and lookalike domains that mimic Indian media outlets. Those choices can help activity blend into web use.

The campaign also shows how a small propagation utility can create serious exposure in controlled settings. It can let a user transport infection across a security boundary.

This is especially relevant for offices where classified records move between administrative workstations and isolated operational systems, because one unvetted drive can undermine that separation during routine device transfers.

APT36 Uses USB-Spreading Malware

At the center of this phase is RUSTYMOVE, a lightweight Windows program written in Rust. Once installed on a compromised computer, it continually watches for USB, SD, MMC, and IEEE 1394 removable devices, checking again every two seconds for new media.

When it finds a drive, the tool copies two prepared files to its root folder: an archive containing the RUSTYSHADE backdoor and a shortcut disguised as a PDF document.

Researchers assess with high confidence that opening the shortcut runs the archived backdoor after extraction, turning the removable drive into a delivery mechanism.

RUSTYMOVE tracks a drive’s unique identifier so it does not repeatedly copy the same files. It has no built-in network command channel or hidden payload of its own, which suggests its narrow role is to spread the attack.

Similar USB-borne tradecraft featured in Mustang Panda SnakeDisk campaign, underlining why isolation alone is not a complete safeguard.

APT36 also created a logon-triggered scheduled task named StandAloneOneDriveUpdater-2626 to start the tool and make it resemble an updater.

Defenders should restrict removable media on sensitive systems, require approved and scanned devices, and investigate unexpected shortcut files, archives, and scheduled tasks running from public-user directories.

Backdoor and Data Theft Tools

The USB component works alongside RUSTYSHADE, a 64-bit Rust backdoor that uses attacker-controlled private GitHub repositories for commands and stolen data.

It encrypts communications, allowing the operator to request directory listings, run shell commands, capture screenshots, take webcam images, and upload files.

The use of a development platform as a control channel can complicate monitoring if organizations treat all GitHub traffic as harmless. That technique has appeared in campaigns, including GitHub infrastructure abuse campaign, making repository API access worth reviewing.

APT36 also used PSNATCH for Windows and BASHNATCH for Linux to search folders, removable-drive letters, and recent files before sending data to private repositories.

PSNATCH limits collection by file size and tracks previously uploaded material, which helps it make smaller follow-up transfers instead of repeatedly taking the same data.

After gaining access, operators ran commands to identify users, processes, connected machines, shares, and reachable systems.

They then tested network services and attempted connections to remote administrative shares, a sequence that shows the campaign is designed to expand beyond its first victim.

Security teams should block the listed domains and URLs, hunt for the named artifacts, and examine unusual PowerShell activity, GitHub API use, and suspicious cloud-storage downloads.

Network segmentation and controls on removable media are especially important where government or defense systems must remain offline.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks appeared first on Cyber Security News.