Transparent Tribe Leverages Private GitHub Repos to Deploy Rust-Based Backdoor Against South Asian Targets

Cyber‑security researchers at Zscaler ThreatLabz have linked a new wave of intrusion attempts to the Pakistan‑aligned threat actor known as Transparent Tribe, also identified in the past as APT36 and Earth Karkaddan. The campaign, which began in early 2024, focuses on government and defence organisations in India and Afghanistan, employing a custom‑written backdoor written in the Rust programming language.

The malicious payload is delivered via seemingly legitimate software updates that pull additional components from private GitHub repositories. By hosting command‑and‑control (C2) infrastructure on private accounts, the group evades many automated detection tools that monitor public code‑hosting services. Once the backdoor is installed, it establishes encrypted channels to the hidden repositories, allowing operators to issue commands, exfiltrate data, and update the malware without raising immediate suspicion.

Transparent Tribe’s choice of Rust marks a notable shift in its toolset. Rust’s memory‑safety guarantees and growing popularity among developers make it an attractive option for adversaries seeking to write resilient, hard‑to‑detect malware. The researchers observed that the Rust binary includes a self‑modifying routine that periodically recompiles parts of its code from source files stored in the private repos, further complicating static analysis.

Analysts note that the targeting pattern aligns with the group’s historical focus on South Asian geopolitical interests. The attacks on Indian ministries and Afghan defence agencies appear timed with regional diplomatic tensions, suggesting a strategic intent to gather intelligence or disrupt critical infrastructure. Zscaler’s report highlights that compromised accounts often belong to low‑privilege users, indicating a “low‑and‑slow” approach that favours stealth over rapid exploitation.

Defence and IT teams in the affected nations are being urged to tighten access controls on code‑hosting platforms, enforce multi‑factor authentication for all GitHub accounts, and monitor network traffic for anomalous connections to GitHub’s private API endpoints. As the use of private repositories for malicious C2 becomes more prevalent, security vendors are expected to update detection signatures and behavioural analytics to flag the distinctive Rust‑based communication patterns. Ongoing investigations aim to map the full extent of the compromised infrastructure and to attribute the operation more precisely within the broader landscape of state‑aligned cyber activity.