The Indian government and defense sector have been targeted in Operation RusticWeb, a phishing campaign using Rust-based malware for intelligence gathering. First detected in October 2023, this campaign utilizes novel payloads and encrypted PowerShell commands to steal documents, with connections to the Pakistan-linked groups Transparent Tribe and SideCopy. SideCopy is involved in multiple campaigns delivering various known trojans like AllaKore RAT, Ares RAT, and DRat. The attacks, often initiated via phishing emails with malicious PDFs, leverage social-engineering to install malware that collects system information and files, sending them to an actor-owned command-and-control (C2) server. A different chain uses a PowerShell script and a Rust executable named “Cisco AnyConnect Web Helper,” uploading data to a public file-sharing engine. This activity is linked to the nation-state actor DoNot Team, known for targeting individuals in Kashmir and India, using Android malware to infiltrate devices. The DoNot group continues to refine their techniques, posing a significant threat, especially in the Kashmir region. CTIX analysts will continue to report on the recent activity of state-sponsored and financially-motivated threat actors.