Unveiling SpiceRAT: Sneaky Chef's latest tool targeting EMEA and Asia
Summary: Cisco Talos found a new malware it named SpiceRAT delivered alongside SugarGh0st in SneakyChef's campaign against government agencies in EMEA and Asia, using at least 28 different RAR attachments in phishing emails sent from a sender posing as "ala de Emissão do Edifício B Mutamba." SpiceRAT is deployed through HTA- or LNK-based chains that sideload a malicious DLL via a legitimate Samsung RunHelp executable, decrypt an RC4-encrypted payload masquerading as a help file, and communicate with C2 servers using three-byte request prefixes such as 0x31716d.
What's compelling: Talos assesses with medium confidence that SneakyChef is a Chinese-speaking actor, and SpiceRAT's plugin can download and run arbitrary binaries and commands, which Talos says significantly increases the attack surface on a victim's network and paves the way for further attacks.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026