APT36 Targets Air-Gapped Networks in India, Afghanistan with USB-Spreading Malware
The Pakistan-linked APT36 group is deploying a campaign named RapidRust, utilizing infected USB drives to infiltrate air-gapped government networks in India and Afghanistan with its RUSTYMOVE and RUSTYSHADE tools.
The cyberespionage group APT36, believed to be linked to Pakistan, has initiated a sophisticated campaign dubbed RapidRust, which leverages infected removable media to breach the security of air-gapped government networks in India and Afghanistan. This operation deploys a multi-faceted toolkit, including a backdoor, data stealers, and a specialized utility designed to spread malware via USB drives. The campaign's primary objective is to infiltrate highly sensitive, physically isolated systems that are intentionally disconnected from the internet to protect critical data and infrastructure.
The core of the RapidRust campaign revolves around a tool named RUSTYMOVE, a compact Windows application developed in the Rust programming language. This utility continuously monitors for the insertion of removable devices such as USB drives, SD cards, and MMC drives. Upon detecting a new device, RUSTYMOVE meticulously copies two essential files to the drive's root directory: an archive containing the RUSTYSHADE backdoor and a seemingly innocuous shortcut file disguised as a PDF document. Researchers have high confidence that executing this shortcut triggers the extraction and deployment of the RUSTYSHADE backdoor, effectively transforming the removable drive into a potent vector for malware propagation.
To ensure efficiency and avoid redundant actions, RUSTYMOVE tracks the unique identifier of each connected drive, preventing it from repeatedly copying the same files. The tool itself lacks any built-in network command capabilities or embedded payloads, underscoring its singular purpose: to facilitate the spread of the attack. This method of using USB-borne tradecraft is not new, echoing tactics seen in campaigns like Mustang Panda's SnakeDisk, and serves as a stark reminder that network isolation alone is insufficient to guarantee security against determined adversaries.
APT36 further enhances the stealth and persistence of its operations by employing a scheduled task named StandAloneOneDriveUpdater-2626. This task is configured to launch RUSTYMOVE automatically upon user logon, mimicking the behavior of a legitimate system updater and potentially evading initial detection by security personnel. This tactic is particularly concerning for environments where classified information is routinely transferred between administrative workstations and isolated operational systems, as a single unvetted USB drive can compromise the integrity of these secure boundaries.
The RUSTYSHADE backdoor, a 64-bit application also written in Rust, serves as the primary command-and-control (C2) channel for APT36. It communicates with attacker-controlled private GitHub repositories, which are used for both issuing commands to compromised systems and exfiltrating stolen data. The backdoor employs encrypted communications, enabling operators to perform a wide range of malicious activities, including requesting directory listings, executing arbitrary shell commands, capturing screenshots, acquiring webcam imagery, and uploading sensitive files.
APT36 also utilizes additional tools like PSNATCH for Windows and BASHNATCH for Linux to conduct reconnaissance and data theft. These tools are designed to scan various locations, including local directories, removable drive letters, and recent files, before transmitting the collected information to private repositories. PSNATCH incorporates mechanisms to limit data collection by file size and tracks previously uploaded material, optimizing subsequent data transfers and reducing the likelihood of redundant uploads.
Following initial access, APT36 operators engage in further reconnaissance by executing commands to identify users, active processes, connected machines, network shares, and reachable systems. They then proceed to probe network services and attempt connections to remote administrative shares, indicating a strategic intent to expand their foothold beyond the initial compromised system. Security teams are advised to implement robust defenses, including blocking known malicious domains and URLs, actively hunting for the identified artifacts, and scrutinizing unusual PowerShell activity, GitHub API usage, and suspicious cloud storage downloads.
Given the nature of this attack, network segmentation and stringent controls on the use of removable media are paramount, especially for government and defense systems that must maintain offline status. The campaign's reliance on private GitHub repositories as a C2 infrastructure highlights the need for organizations to review and potentially restrict access to development platforms that might otherwise be considered benign. The blend of social engineering (lookalike domains) and technical exploitation (USB spreading, backdoor C2) makes RapidRust a significant threat to the security of disconnected networks.