APT36, also known as “Transparent Tribe,” “Mythic Leopard,” or “Earth Karkaddan,” launched another operation that Zscaler has been tracking as RapidRust. The Pakistan-linked threat group used four malware variants—RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH—in their latest campaigns. APT36 also registered lookalike domains to impersonate popular Indian news outlets in their attacks.

The report publicized five RapidRust network IoCs comprising two subdomains and three domains. We extracted another domain from the subdomains but upon checking with the WhoisXML API MCP Server, it turned out to be legitimate. We thus had to exclude it from our analysis that focused on five network IoCs—two subdomains and three domains.

Our RapidRust DNS deep dive uncovered these findings:

• 341 email-connected domains
• Two IP addresses, both of which were confirmed malicious
• Three IP-connected domains
• 53 string-connected domains

A sample of the additional artifacts obtained from our analysis is available for download from our website.

RapidRust Subdomain IoC Analysis

We kicked off our RapidRust investigation by looking more closely at the two subdomain IoCs. Here are some of the results of our subdomain analysis via the WhoisXML API MCP Server.

RapidRust Domain IoC Investigation

Next, we zoomed in on the three domain IoCs by querying them on WHOIS API. We discovered that:

• They were all created in 2026, one on 11 May, another on 30 June, and the last one on 17 August.
• They were all administered by Namecheap.
• While one did not have a registrant country on record, the remaining two were registered in a different country each.

We also queried the IoCs on DNS Chronicle API and learned that they posted 96 historical domain-to-IP resolutions so far. Here are more details about them.

Hunt for New RapidRust Artifacts

We started our search for new artifacts by querying the domain IoCs on WHOIS History API. We discovered three unique email addresses in their historical WHOIS records. And one of them, upon further scrutiny, was a public email address.

When we queried the public email address on Reverse WHOIS API, we uncovered 341 distinct email-connected domains after those already dubbed as IoCs were filtered out.

While none of the email-connected domains are currently considered malicious, many seem to be riding on the popularity of global brands. Here are three examples.

In addition, despite low visitor numbers, two email-connected domains did get hits on Domain Traffic API—foodlion[.]info (1 on 6 January 2026) and superdupes[.]org (2 on 21 September 2026).

We then queried the IoCs on DNS Lookup API and found out that two were hosted on two unique IP addresses. When queried on Threat Intelligence API, both turned out to be malicious. The IP 147[.]182[.]160[.]170, for instance, has been associated with malware distribution since 19 September 2026.

This post only contains a snapshot of the full research. Download the complete findings and a sample of the additional artifacts on our website or contact us to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

Disclaimer: We take a cautionary stance toward threat detection and aim to provide relevant information to help protect against potential dangers. Consequently, it is possible that some entities identified as “threats” or “malicious” may eventually be deemed harmless upon further investigation or changes in context. We strongly recommend conducting supplementary investigations to corroborate the information provided herein.