MagicRAT: Lazarus’ latest gateway into victim networks
Summary: Cisco Talos discovered a new remote access trojan it calls MagicRAT, attributed with moderate to high confidence to the North Korean state-sponsored Lazarus group, found on victims initially compromised through exploitation of publicly exposed VMware Horizon platforms. MagicRAT is written in C++ and statically links the Qt Framework, which Talos says was done to complicate human analysis and make machine learning and heuristic detection less reliable, and its C2 infrastructure also hosted newer TigerRAT variants and a GIF-disguised port scanner called pct.gif.
What you should know: The implant is deliberately built to evade the automated detection most security programs lean on, and its operators swapped MagicRAT out for other custom malware such as VSingle on some infected systems, meaning a single detection may not reflect what is actually running on a host.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026