APT36 deploys four malware variants in RapidRust cyber campaign

The Pakistan-linked group APT36 deployed four malware variants in its RapidRust campaign, CircleID reported. The group, also known as Transparent Tribe, Mythic Leopard, or Earth Karkaddan, used lookalike domains to impersonate popular Indian news outlets during the attacks. [1]

CircleID reported that cybersecurity researchers at Zscaler tracked the RapidRust operation. The investigation identified malicious infrastructure linked to four specific malware variants, which are RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. [1]

An analysis of the campaign infrastructure uncovered 341 email-connected domains, two malicious IP addresses, and 53 domains sharing naming patterns with known indicators, according to CircleID. The report publicized five RapidRust network indicators of compromise, which consisted of two subdomains and three domains. [1]

An advanced persistent threat is a stealthy cybersecurity threat where an unauthorized party gains access to a network and remains undetected over an extended period. These operations are typically manipulated by state or state-sponsored groups. The Domain Name System translates human-readable domain names into numerical IP addresses required to locate computer services on network protocols. [2][3]