The Hacker Newsinfo@thehackernews.com (The Hacker News)
Transparent Tribe Linked to Rust Backdoor Using GitHub for C2
Part of the Operation C-Major story · since 25 Aug 2025
Quiet for 3 weekslast report 15 Oct18 articles5 outlets
- Mon 25 Aug, 09:22 UTC. Security Affairs, first report. Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign.
- Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. Beyond Windows: Pakistan's APT36 Group Is Now Attacking Linux Systems with Stealthy Malware.
- Tue 21 Oct, 06:15 UTC. GBHackers, its first report on the story. Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government.
- Fri 24 Oct, 14:50 UTC. The Hacker News, its first report on the story. APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign.
- Tue 2 Dec, 01:41 UTC. SecurityOnline. The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems.
- Fri 2 Jan, 14:35 UTC. The Hacker News. Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia.
- Mon 5 Jan, 00:40 UTC. SecurityOnline. Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India.
- Wed 11 Feb, 16:25 UTC. The Hacker News. APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities.
- Thu 5 Mar, 22:45 UTC. Dark Reading, its first report on the story. APT36 scales AI driven malware line to hit Indian entities.
- Fri 6 Mar, 15:34 UTC. The Hacker News. Transparent Tribe builds AI driven mass implants to hit India.
- Mon 20 Jul, 08:20 UTC. SecurityOnline. SheetAgent RAT hits Indian job seekers via fake govt zip.
- Sun 16 Aug, 08:40 UTC. Security Affairs. APT36 uses fake VPN installers to deploy PATCHCORD backdoor.
- Wed 19 Aug, 10:21 UTC. SecurityOnline. APT36 Uses PATCHCORD Malware Against Afghan Telecom, Indian Govt.
- Thu 20 Aug, 15:31 UTC. Dark Reading. Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks.
- Fri 18 Sep, 16:18 UTC. The Hacker News. Transparent Tribe Linked to Rust Backdoor Using GitHub for C2. This article, 16th of 18.
- Tue 22 Sep, 08:23 UTC. SecurityOnline. APT36 Uses Fake News Sites to Target India and Afghanistan Governments.
- Thu 15 Oct, 21:13 UTC. Dark Reading. AI Is Making Cyberattacks Noisier, Not More Sophisticated.
Transparent Tribe has been linked to a new Rust-based backdoor that uses private GitHub repositories for command-and-control (C2), according to a report published by The Hacker News on 18 September 2026. The supplied material identifies the activity as cyber espionage and attributes it to Transparent Tribe, but does not provide details about confirmed victims, targeted sectors or the scale of any campaign.
The article content supplied does not include the body of the report or technical findings explaining how the malware is delivered, how it authenticates to the private repositories, what commands it supports, or whether the activity has resulted in confirmed exploitation. It therefore does not provide enough evidence to assess affected systems or recommend a specific response beyond noting the reported use of GitHub infrastructure for C2.
How the story developed
Quiet for 3 weekslast report 15 Oct18 articles5 outlets
18 articles from 5 outlets since 25 Aug. Quiet since 15 Oct. This was the 16th report, 389 days after the first.
- Mon 25 Aug, 09:22 UTC. Security Affairs, first report. Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign.
- Tue 26 Aug, 19:28 UTC. SecurityOnline, its first report on the story. Beyond Windows: Pakistan's APT36 Group Is Now Attacking Linux Systems with Stealthy Malware.
- Tue 21 Oct, 06:15 UTC. GBHackers, its first report on the story. Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government.
- Fri 24 Oct, 14:50 UTC. The Hacker News, its first report on the story. APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign.
- Tue 2 Dec, 01:41 UTC. SecurityOnline. The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems.
- Fri 2 Jan, 14:35 UTC. The Hacker News. Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia.
- Mon 5 Jan, 00:40 UTC. SecurityOnline. Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India.
- Wed 11 Feb, 16:25 UTC. The Hacker News. APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities.
- Thu 5 Mar, 22:45 UTC. Dark Reading, its first report on the story. APT36 scales AI driven malware line to hit Indian entities.
- Fri 6 Mar, 15:34 UTC. The Hacker News. Transparent Tribe builds AI driven mass implants to hit India.
- Mon 20 Jul, 08:20 UTC. SecurityOnline. SheetAgent RAT hits Indian job seekers via fake govt zip.
- Sun 16 Aug, 08:40 UTC. Security Affairs. APT36 uses fake VPN installers to deploy PATCHCORD backdoor.
- Wed 19 Aug, 10:21 UTC. SecurityOnline. APT36 Uses PATCHCORD Malware Against Afghan Telecom, Indian Govt.
- Thu 20 Aug, 15:31 UTC. Dark Reading. Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks.
- Fri 18 Sep, 16:18 UTC. The Hacker News. Transparent Tribe Linked to Rust Backdoor Using GitHub for C2. This article, 16th of 18.
- Tue 22 Sep, 08:23 UTC. SecurityOnline. APT36 Uses Fake News Sites to Target India and Afghanistan Governments.
- Thu 15 Oct, 21:13 UTC. Dark Reading. AI Is Making Cyberattacks Noisier, Not More Sophisticated.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 18 articles as a listHide the list
- Mon 25 AugDay 01
- Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign09:22 · Security Affairs · First report
- Tue 26 AugDay 11
Quiet for 8 weeks
Tue 21 OctDay 571- Pakistani Cyber Actors Impersonating ‘NIC eEmail Services’ to Target Indian Government06:15 · GBHackers · Picked up again
Quiet for 3 days
Fri 24 OctDay 601- APT36 Targets Indian Government with Golang-Based DeskRAT Malware Campaign14:50 · The Hacker News · Picked up again
Quiet for 5 weeks
Tue 2 DecDay 991- The BOSS Breach: APT36 Pivots to Linux Espionage with “Silent” Shortcuts01:41 · SecurityOnline · Picked up again
Quiet for 3 weeks
Wed 24 DecDay 1211- APT-36 Uses Fake “WhatsApp Fraud” Advisory to Hack Government Systems01:50 · SecurityOnline · Picked up again
Quiet for 10 days
Fri 2 JanDay 1301- Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia14:35 · The Hacker News · Picked up again
Quiet for 2 days
Mon 5 JanDay 1331- Transparent Tribe Weaponizes “JLPT” Tests in New Cyber-Espionage Campaign Against India00:40 · SecurityOnline · Picked up again
Quiet for 5 weeks
Wed 11 FebDay 1701- APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities16:25 · The Hacker News · Picked up again
Quiet for 3 weeks
Thu 5 MarDay 1921- APT36 scales AI driven malware line to hit Indian entities22:45 · Dark Reading · Picked up again
- Fri 6 MarDay 1931
- Transparent Tribe builds AI driven mass implants to hit India15:34 · The Hacker News
Quiet for 19 weeks
Mon 20 JulDay 3291- SheetAgent RAT hits Indian job seekers via fake govt zip08:20 · SecurityOnline · Picked up again
Quiet for 4 weeks
Sun 16 AugDay 3561- APT36 uses fake VPN installers to deploy PATCHCORD backdoor08:40 · Security Affairs · Picked up again
Quiet for 3 days
Wed 19 AugDay 3591- APT36 Uses PATCHCORD Malware Against Afghan Telecom, Indian Govt10:21 · SecurityOnline · Picked up again
- Thu 20 AugDay 3601
- Pakistan's Transparent Tribe Refreshes Toolset for Afghan Cyberattacks15:31 · Dark Reading
Quiet for 4 weeks
Fri 18 SepDay 3891- Transparent Tribe Linked to Rust Backdoor Using GitHub for C216:18 · The Hacker News · Picked up again · This article, 16th of 18
Quiet for 4 days
Tue 22 SepDay 3931- APT36 Uses Fake News Sites to Target India and Afghanistan Governments08:23 · SecurityOnline · Picked up again
Quiet for 3 weeks
Thu 15 OctDay 4161- AI Is Making Cyberattacks Noisier, Not More Sophisticated21:13 · Dark Reading · Picked up again