Forest Global Training Partners

Cyber Risks · Cisco Talos

GravityRAT - The Two-Year Evolution Of An APT Targeting India

Summary: Cisco Talos documented GravityRAT, a remote access trojan under active development for at least 18 months, with variants adding file exfiltration, remote command execution, and seven separate anti-VM checks, including a WMI query to the MSAcpi_ThermalZoneTemperature entry that returns "not supported" on Hyper-V, VMware, VirtualBox, KVM, and Xen. India's NIC CERT published an advisory in August 2017 naming the C2 infrastructure, and Cisco Umbrella data showed all listed C2 domains were requested at least 50 percent by Indian IP infrastructure, while test samples were uploaded to VirusTotal from Pakistan and one PDB path contained "Adeel's Laptop."

What's compelling: The developer used VirusTotal to iterate on malicious documents until detection ratios dropped, and the temperature check alone can flag a sandbox as a VM, so analysis environments built on common hypervisors may be identified before the payload fully executes.

Read the original at Cisco Talos ↗

Topics
Malware
Related