ObliqueRAT: New RAT hits victims' endpoints via malicious documents
Summary: Cisco Talos discovered a new RAT family it calls ObliqueRAT, dropped to endpoints through password-protected malicious Microsoft Word documents whose VBA scripts activate once the user enters the password, likely sent by email with the password in the message body. Talos also linked ObliqueRAT to a December 2019 campaign distributing CrimsonRAT, which has targeted diplomatic and government organizations in Southeast Asia, and found a preliminary Variant #0 that appears to be a test copy released without scrubbing its debugging message boxes.
Why it matters: The implant carries a blacklist of usernames and computer names it refuses to run on, and it can zip and exfiltrate files, run command lines, and terminate processes on demand from its hardcoded C2 - a capability set that arrives on the endpoint inside a document a user was persuaded to open.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026