Rust, GitHub, and USB: How a Familiar Espionage Cluster Kept Its Edge

Some campaigns are notable not because they invent a new idea, but because they stitch old ideas together in a way that is harder to interrupt. The activity tied to APT36 and tracked as Operation RapidRust fits that pattern. It centers on government and defense targets in India and Afghanistan, and it highlights a design choice that security teams cannot ignore: malware built to move between connected systems and isolated networks without relying on one brittle delivery path.

Fast Facts

• Operation RapidRust was observed in August 2026 and is associated with a renewed espionage effort.
• The campaign is reported to use a Rust-based malware suite rather than a single standalone payload.
• The tooling is described as supporting covert command-and-control, data theft, and propagation into isolated networks.
• The targets named are government and defense organizations in India and Afghanistan.
• The broader technical pattern suggests removable media and cloud services are being treated as part of the attack surface.

Why the design matters

Rust is not the story by itself. It matters because it can raise the cost of analysis, especially when defenders are already juggling multiple loaders, stealers, and transport methods. In this case, the reported toolkit appears to be built as a small ecosystem rather than a one-shot implant. That is a familiar espionage pattern: one component for tasking, another for collection, and another for moving through constrained environments.

One of the more important defensive signals is the emphasis on propagation into isolated networks. That phrase should not be read as proof of a successful air-gap breach. It does, however, point to a threat model that assumes removable media, offline transfers, or human handling may bridge the gap. In government and defense environments, that is often the weak link, not the firewall.

Netcrook analysis also suggests why cloud services deserve attention here. When operators route communications or staging through legitimate platforms, they can blend malicious traffic into normal business use. That does not make detection impossible, but it pushes defenders toward stronger egress control, tighter identity monitoring, and more selective trust in collaboration tools.

At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream systems were compromised. The available information supports a risk analysis, not a definitive claim of full breach.

For defenders, the lesson is practical: treat USB controls, script monitoring, and outbound access rules as one control plane, not separate problems. A campaign that spans Windows, Linux, and removable media can slip through gaps left by narrow monitoring. The broader warning is simple - when an attacker’s toolkit is designed for movement, the perimeter must be designed for friction.

Conclusion

Operation RapidRust is a reminder that espionage tradecraft is increasingly modular. A Rust backdoor, a removable-media bridge, and cloud-based tasking can be combined to make a campaign more resilient without making it magical. The real lesson is not that one language or one platform is dangerous on its own. It is that defenders need to watch how ordinary technologies are chained together into a covert operational path.

TECHCROOK

USB hardware write blocker: A practical accessory for teams that must inspect removable media without allowing the connected device to write back to it. It is commonly used in forensics, incident response, and controlled transfer workflows. It does not make USB use risk-free, but it can add a useful layer of handling discipline when offline files, shared drives, or evidence collection are part of the process.

Scheda Techcrook: USB hardware write blocker

WIKICROOK

• Command-and-control (C2): The channel attackers use to send instructions to malware and receive stolen data.
• Rust: A programming language with strong safety features that can still produce malicious binaries.
• Removable media: Portable storage such as USB drives that can carry malware between systems.
• Air-gapped network: A system or network kept physically separate from the internet and other external links.
• Egress control: Rules that limit where internal systems can send outbound traffic.