Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

UBoatRAT Navigates East Asia

Summary: Palo Alto Networks Unit 42 identified a custom remote access trojan it calls UBoatRAT, first found in May 2017 as a simple HTTP backdoor using a Hong Kong blog service and a compromised Japanese web server for command and control, with updated versions released in June and September. The RAT is delivered from Google Drive in archives disguised as folders, Excel spreadsheets or Word documents, copies itself to C:\programdata\svchost.exe, and persists via a BITS job using bitsadmin /SetNotifyCmdLine, which keeps running after reboots and remains in the queue for 90 days by default unless completed or cancelled.

What you should know: Unit 42 counted fourteen UBoatRAT samples plus one downloader, and the author was still updating the elsa999 GitHub account in October, after the September release - a developer iterating in the open while the tool stays live. The persistence mechanism is the part to sit with: a BITS job that survives reboots and sits in the queue for 90 days unless explicitly completed or cancelled.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related