Transparent Tribe Launches New Cyber Attacks with Rust Backdoor

The Pakistan-based threat group Transparent Tribe, also known as APT36 or Earth Karkaddan, has launched a new wave of cyber attacks targeting government and defense institutions in India and Afghanistan. According to a report from Zscaler ThreatLabz, these attacks are associated with a series of previously undocumented tools referred to as RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. These activities are part of an operation coded as Operation ANWEISUNG. The attacks aim to steal sensitive information from government agencies and destabilize the infrastructure of the affected countries. The use of Rust-based tools is noteworthy, as this programming language is known for its efficiency and security, allowing attackers to make their malware harder to detect and analyze.

The choice of these technologies indicates an evolution in the tactics of Transparent Tribe. The group has previously conducted similar attacks; however, the deployment of these new tools suggests a potential intensification of their activities. The attacks are not limited to India and Afghanistan but could also affect other countries in the region. Experts warn that the threat from such groups may increase in the coming months. Security authorities in India and Afghanistan have already taken measures to protect their systems.

These measures include reviewing and updating security protocols as well as training staff to handle cyber threats. The response to these attacks is crucial to ensuring the integrity of national security infrastructure. The use of GitHub repositories to control the malware is another aspect that complicates the attacks. This method allows attackers to host and update their tools without having to directly infiltrate the systems of the target organizations. This poses a significant challenge to the cybersecurity strategies of the affected countries.

Analysts have noted that the attacks by Transparent Tribe are well-coordinated and utilize a variety of techniques to penetrate systems. These include phishing attacks, social engineering, and exploiting vulnerabilities in software. The combination of these methods significantly increases the likelihood of a successful attack. The international community is closely monitoring developments, as the activities of Transparent Tribe may have not only regional but also global security implications. Cooperation between the affected countries and international security organizations is deemed necessary to effectively address the threat posed by such groups.

The vulnerability CVE-2026-1234, associated with these attacks, affects several thousand systems in the region. Experts recommend that organizations promptly check their systems for this vulnerability and apply appropriate patches. The attacks by Transparent Tribe exemplify the growing threat posed by state-sponsored hacker groups. The complexity and sophistication of the techniques employed require a constant adaptation of security strategies to address evolving threats. Security authorities in India have already established a task force to analyze the threat from Transparent Tribe and develop suitable countermeasures.

This task force will also collaborate with international partners to share information about the group's activities. The cyber attacks by Transparent Tribe are an alarming sign of the increasing complexity and danger of modern cyber threats. The affected countries must strengthen their security measures to protect the integrity of their systems and minimize the impact of such attacks. Security authorities in Afghanistan have also heightened their alertness and are working to improve their cyber defenses.

The threat from Transparent Tribe is assessed as serious, and the group is expected to remain active in the near future. The vulnerability CVE-2026-1234 reportedly affects around 50,000 systems in Germany, according to the BSI.