An investigation of APT36’s RapidRust campaign identified malicious infrastructure linked to four malware variants, uncovering 341 email-connected domains, two malicious IP addresses, and 53 domains sharing naming patterns with known indicators.