APT36 Deploys Rust-Based Spyware in Fresh Campaign Against Indian and Afghan Defense Agencies

A cyber espionage group linked to Pakistan, known as APT36, has launched a new intrusion effort aimed at government and defense entities in India and Afghanistan, according to security researchers who first reported the activity. The operation hinges on a freshly developed malware suite written in the Rust programming language, a choice that signals a shift toward more resilient and harder‑to‑detect tools.

The Rust‑based toolkit is engineered to establish stealthy command‑and‑control (C2) channels, exfiltrate sensitive files, and spread laterally within isolated networks that are typically shielded from internet‑connected threats. Analysts say the code’s low‑level footprint and built‑in memory safety features make it difficult for conventional antivirus products to flag the malicious binaries.

APT36, also referred to in past reports as Transparent Tribe, has a documented history of focusing on South Asian targets, especially Indian military, diplomatic and intelligence institutions. The group’s earlier campaigns employed a mix of credential‑stealing malware, phishing lures and custom backdoors. The recent adoption of Rust marks a technical evolution, reflecting a broader trend among advanced threat actors to exploit newer development stacks that evade legacy detection signatures.

Researchers from the independent security community GBHackers, who first disclosed the campaign, observed that the new malware is distributed through spear‑phishing emails containing malicious attachments or links. Once a victim executes the payload, the Rust binary initiates a covert handshake with a remote server, allowing operators to issue commands, retrieve data, and push additional modules designed to deepen infiltration. The modular nature of the suite enables the attackers to tailor their actions to the specific environment of each compromised organization.

While the exact number of affected entities remains unclear, the targeting of defense and governmental bodies underscores the strategic intent of the campaign: to harvest intelligence that could inform regional security calculations. The inclusion of Afghan organizations expands the geographic scope beyond the group’s traditional focus on India, suggesting a possible alignment with broader geopolitical objectives tied to the Indo‑Pakistani rivalry.

Cybersecurity experts caution that the use of Rust could complicate incident response efforts. Traditional sandbox environments may struggle to emulate the language’s runtime behavior, and the malware’s ability to operate without obvious system calls can hinder behavioral analysis. Organizations are advised to reinforce email hygiene, employ multi‑factor authentication, and monitor for anomalous network traffic that could indicate stealthy C2 activity.

The emergence of this Rust‑based arsenal adds a new dimension to the ongoing cyber contest in South Asia. As defensive teams adapt to the evolving threat landscape, analysts expect that APT36 and similar groups will continue to experiment with emerging technologies to maintain a foothold in high‑value targets. Ongoing collaboration between industry, academia, and government agencies will be essential to detect, attribute, and mitigate such sophisticated intrusion attempts.