Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Threat Actors
Excerpt
IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan. During our investigation,…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://clients-easy.s3.us-east-005.backblazeb2.com/Automata-20.zip | High | Score 58/100 | First seen |
| URL | https://f005.backblazeb2.com/file/Clients-easy/DriverInstaller.zip | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…