CRAT wants to plunder your endpoints
Summary: Cisco Talos discovered a new version of the CRAT malware family, a highly modular RAT that can download and activate plugins from its C2 servers, with plugins found so far including ransomware, screen-capture, clipboard monitoring and keylogger components. CRAT has previously been attributed to the Lazarus Group, and the investigation's indicators and TTPs resemble that group's, though the distribution vector for CRATv2 is currently unknown while CRATv1 spread through malicious COVID-19-themed HWP documents exploiting CVE-2017-8291.
What you should know: The ransomware plugin does not use conventional encryption: it locks files into individually created archives with randomly generated passwords, and the BTC addresses discovered so far hold no money with no transactions in or out. A RAT attributed to Lazarus Group that can pull fresh plugins - including ransomware - onto an endpoint on command means the capability set on any given host is not fixed at infection time.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2017-8291
- Related
- CVE-2017-8291: Artifex Ghostscript Type Confusion Vulnerability Known Exploited Vulnerabilities · May 24, 2022University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026