Forest Global Training Partners

Cyber Risks · Cisco Talos

RAT Ratatouille: Backdooring PCs with leaked RATs

Summary: Cisco Talos found a threat actor distributing Orcus RAT and RevengeRAT in email campaigns targeting government entities, financial services organizations, IT service providers and consultancies, with messages posing as complaints from the Better Business Bureau, ACCC, MBIE and other regional agencies. Early campaigns used SendGrid links to redirect victims to a ZIP archive containing a PE32 loader disguised with a double extension (478766766.pdf.exe), while later campaigns attached ZIP archives holding batch files that retrieved the payload; the loader injects Orcus into its own process so the RAT is never written to disk in clear text.

Key Takeaway: The source code for both RATs has leaked publicly, so unrelated attackers keep rebuilding them with minor changes that alter the binary enough to look different to antivirus, and Talos says new variants will keep appearing for the foreseeable future.

Read the original at Cisco Talos ↗

Topics
Malware
Related