ObliqueRAT returns with new campaign using hijacked websites
Summary: Cisco Talos discovered a new ObliqueRAT campaign, ongoing since April 2020, that replaces embedded maldoc payloads with malicious macros pointing to adversary-controlled websites hosting BMP images with executable bytes hidden in the image data. Talos found three new versions of the RAT, including v6.3.2, which adds webcam capture to C:\ProgramData\wsc, screenshots to C:\ProgramData\tsc, recursive drive enumeration logged to C:\ProgramData\DirecTree.txt, and file collection from removable drives into C:\ProgramData\System\Recycled and C:\ProgramData\System\Dump.
Why it matters: Talos assesses with low confidence a possible link between ObliqueRAT and RevengeRAT, whose leaked .NET source code lets actors skip building implants and C2 servers from scratch and muddies attribution. The implant also persists through a .url shortcut in the infected user's Startup directory, so a single opened maldoc survives reboot.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026