Tag: rat
-
Nebulous Mantis Targets NATO-Linked Entities with Multi-Stage Malware Attacks
Tags: access, attack, communications, control, cyber, cybersecurity, espionage, group, infrastructure, malware, rat, russia, tacticsCybersecurity researchers have shed light on a Russian-speaking cyber espionage group called Nebulous Mantis that has deployed a remote access trojan called RomCom RAT since mid-2022.RomCom “employs advanced evasion techniques, including living-off-the-land (LOTL) tactics and encrypted command and control (C2) communications, while continuously evolving its infrastructure leveraging First seen on thehackernews.com Jump to article: thehackernews.com/2025/04/nebulous-mantis-targets-nato-linked.html
-
Python-Based Discord RAT Enables Remote Control and Disruption Through a Simple Interface
A newly analyzed Python-based Remote Access Trojan (RAT) has emerged as a significant cybersecurity threat, utilizing Discord as its command-and-control (C2) platform. Disguised as a benign script, this malware transforms the popular communication tool into a hub for malicious operations, allowing attackers to remotely control infected systems with alarming ease. By exploiting Discord’s encrypted traffic…
-
Chinese hackers target Russian govt with upgraded RAT malware
Chinese-speaking IronHusky hackers are targeting Russian and Mongolian government organizations using upgraded MysterySnail remote access trojan (RAT) malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-target-russian-govt-with-upgraded-rat-malware/
-
Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader
A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader.”Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution,” Palo Alto Networks Unit 42 researcher Saqib Khanzada said in a technical write-up of the campaign.The First…
-
IronHusky APT Resurfaces with Evolved MysterySnail RAT
In a newly released report, Kaspersky’s Global Research and Analysis Team (GReAT) has revealed the resurgence of IronHusky, First seen on securityonline.info Jump to article: securityonline.info/ironhusky-apt-resurfaces-with-evolved-mysterysnail-rat/
-
Neue ResolverRAT-Malware zielt auf Gesundheitsbranche
Der neue Remote Access Trojaner ResolverRAT nutzt DLL-Side-Loading-Probleme aus.Forscher von Morphisec haben einen neuen Remote Access Trojaner (RAT) mit dem Namen ResolverRAT entdeckt, der über Phishing-E-Mails mit bösartigen Anhängen verbreitet wird. Die Angreifer nutzen dabei als Köder Begriffe wie Urheberrechtsverletzungen, verschiedene Rechtsverstöße und laufende Ermittlungen. Die E-Mails sind in mehreren Sprachen verfasst, darunter Englisch, Hindi,…
-
UNC5174: Chinese Threat Actor Deploys New VShell RAT in Campaign
The Sysdig Threat Research Team (TRT) has uncovered a new campaign by the Chinese state-sponsored threat actor UNC5174, First seen on securityonline.info Jump to article: securityonline.info/unc5174-chinese-threat-actor-deploys-new-vshell-rat-in-campaign/
-
New ResolverRAT malware targets healthcare and pharma orgs worldwide
Tags: authentication, control, data, encryption, group, healthcare, infrastructure, malware, monitoring, network, organized, rat, strategy, threat, toolPersistence and stealthy C2 communication: The new RAT employs multiple persistence strategies, including more than 20 obfuscated registry entries and files dropped in multiple folders on disk. The malware keeps a record of which persistence techniques were successful to use them as a fallback mechanism.Communication with the command-and-control (C2) server uses TLS encryption with a…
-
Chinese Hackers Deploy Stealthy Fileless VShell RAT
Malware Hides in Memory, Evades Detection by Endpoint Tools. A Chinese state-backed hacking group tracked as UNC5174 relaunched its operations after a year of silence with a campaign using a memory-only remote access Trojan that evades traditional detection mechanisms, according to new research from cybersecurity firm Sysdig. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-hackers-deploy-stealthy-fileless-vshell-rat-a-28012
-
A New ‘It RAT’: Stealthy ‘Resolver’ Malware Burrows In
A new infostealer on the market is making big waves globally, replacing Lumma et al. in attacks and employing so many stealth, persistence, and anti-analysis tricks that it’s downright difficult to count them all. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/it-rat-stealthy-resolver-malware
-
Pakistan-Linked Hackers Expand Targets in India with CurlBack RAT and Spark RAT
A threat actor with ties to Pakistan has been observed targeting various sectors in India with various remote access trojans like Xeno RAT, Spark RAT, and a previously undocumented malware family called CurlBack RAT.The activity, detected by SEQRITE in December 2024, targeted Indian entities under railway, oil and gas, and external affairs ministries, marking an…
-
Scattered Spider persists with use of Spectre RAT, new phishing kit
First seen on scworld.com Jump to article: www.scworld.com/news/scattered-spider-persists-with-use-of-spectre-rat-new-phishing-kit
-
G20 Gipfel als Köder: Gh0st-RAT greift tibetische Aktivisten an
Es ist wohlbekannt, dass ATP-Akteure wichtige Ereignisse gern ausnutzen, um zielgerichtete Angriffe durchzuführen. Ebenso berüchtigt sind Attacken gegen tibetische NGOs. Aus diesem Grund sind wir davon ausgegangen, dass im Vorfeld des G20 Gipfels einige zielgerichtete Bedrohungen zu sehen sein würden. First seen on welivesecurity.com Jump to article: www.welivesecurity.com/deutsch/2014/11/17/g20-gipfel-als-koder-gh0st-rat-greift-tibetische-aktivisten/
-
Blackhat: Wie realistisch ist der neue Film von Michael Mann?
Der Hackerfilm Blackhat nutzt definitiv eine Cybersicherheits-Sprache mit echten Begriffen wie: Malware, Proxy, Server, Zero Day, Payload, RAT, Edge Router, IP-Adresse, PLC, Bluetooth, Android, PGP, Bulletproof Host und USB, um nur ein paar zu nennen. Aber wie realistisch ist die Geschichte des Films tatsächlich? First seen on welivesecurity.com Jump to article: www.welivesecurity.com/deutsch/2015/01/30/blackhat-wie-realistisch-ist-der-neue-film-von-michael-mann/
-
Neptune RAT spreads across GitHub, Telegram, and YouTube
First seen on scworld.com Jump to article: www.scworld.com/news/neptune-rat-spreads-across-github-telegram-and-youtube
-
Novel Neptune RAT variant sets sights on Windows
First seen on scworld.com Jump to article: www.scworld.com/brief/novel-neptune-rat-variant-sets-sights-on-windows
-
Dangerous, Windows-Hijacking Neptune RAT Scurries Into Telegram, YouTube
The malware’s creators insist a new open source version of Neptune is for educational use by pen testers, but a raft of sophisticated backdoor and evasion capabilities says otherwise. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/windows-hijacking-neptune-rat-telegram-youtube
-
Scattered Spider stops the Rickrolls, starts the RAT race
Tags: ratDespite arrests, eight-legged menace targeted more victims this year First seen on theregister.com Jump to article: www.theregister.com/2025/04/08/scattered_spider_updates/
-
Neptune RAT Variant Spreads via YouTube to Steal Windows Passwords
A new Neptune RAT variant is being shared via YouTube and Telegram, targeting Windows users to steal passwords and deliver additional malware components. First seen on hackread.com Jump to article: hackread.com/neptune-rat-variant-youtube-steal-windows-passwords/
-
NEPTUNE RAT Targets Windows Users, Steals Passwords from 270+ Applications
A recent cyber threat named Neptune RAT has emerged as a rising concern for Windows users, targeting sensitive data and exhibiting advanced malicious capabilities. CYFIRMA researchers have identified the latest version of this Remote Access Trojan (RAT), revealing alarming details about its distribution, functionality, and impact on compromised systems. Technical Overview of Neptune RAT Neptune…
-
Hackers Selling SnowDog RAT Malware With Remote Control Capabilities Online
A sophisticated remote access trojan (RAT) dubbedSnowDoghas surfaced on underground cybercrime forums, prompting alarms among cybersecurity experts. Advertised as a tool for “corporate espionage and advanced intrusions,” the malware is being sold by an unidentified threat actor with claims of stealth, evasion, and remote control capabilities. The SnowDog RAT: Features and Risks The seller claims…
-
Ongoing Gamaredon phishing campaign targets Ukraine with Remcos RAT
First seen on scworld.com Jump to article: www.scworld.com/brief/ongoing-gamaredon-phishing-campaign-targets-ukraine-with-remcos-rat
-
Triton RAT Uses Telegram for Remote System Access and Control
Cado Security Labs has uncovered a new Python-based Remote Access Tool (RAT) named Triton RAT, which leverages Telegram for remote system access and data exfiltration. This open-source malware, available on GitHub, is designed to execute a wide range of malicious activities, including credential theft, system control, and persistence establishment. Technical Overview Triton RAT initiates its…
-
Konni RAT Exploit Windows Explorer Limitations To Launches a Multi-Stage Attack Steal Data
Konni RAT, a highly advanced Remote Access Trojan (RAT), has emerged as a significant cybersecurity threat, leveraging Windows Explorer limitations to execute multi-stage attacks. This malware employs a combination of batch files, PowerShell scripts, and VBScript to infiltrate systems, exfiltrate sensitive data, and maintain persistence. Its ability to evade detection through obfuscation and stealth makes…
-
Russia-linked Gamaredon targets Ukraine with Remcos RAT
Tags: apt, attack, cyberespionage, group, phishing, powershell, rat, russia, spear-phishing, ukraineRussia-linked Gamaredon targets Ukraine with a phishing campaign using troop-related lures to deploy the Remcos RAT via PowerShell downloader. Talos researchers warn that Russia-linked APT group Gamaredon (a.k.a. Armageddon, Primitive Bear, ACTINIUM, Callisto) targets Ukraine with a phishing campaign. The cyberespionage group is behind a long series of spear-phishing attacks targeting Ukrainian entities, and organizations related…
-
Russia-Linked Gamaredon Uses Troop-Related Lures to Deploy Remcos RAT in Ukraine
Entities in Ukraine have been targeted as part of a phishing campaign designed to distribute a remote access trojan called Remcos RAT.”The file names use Russian words related to the movement of troops in Ukraine as a lure,” Cisco Talos researcher Guilherme Venere said in a report published last week. “The PowerShell downloader contacts geo-fenced…
-
New Python-Based Discord RAT Targets Users to Steal Login Credentials
A recently identified Remote Access Trojan (RAT) has raised alarms within the cybersecurity community due to its innovative use of Discord’s API as a Command and Control (C2) server. This Python-based malware exploits Discord’s extensive user base to execute commands, steal sensitive information, and manipulate both local machines and Discord servers. Bot Initialization and Functionality…
-
Ukrainian defense sector hit with Dark Crystal RAT
First seen on scworld.com Jump to article: www.scworld.com/brief/ukrainian-defense-sector-hit-with-dark-crystal-rat