Blackremote: Money Money Money – A Swedish Actor Peddles an Expensive New RAT
Summary: Unit 42 researchers documented a new commodity RAT called Blackremote, sold by a Swedish actor using the handles Speccy and Rafiki, which drew almost 50 samples across more than 2,200 attack sessions in its first month on sale. The RAT is licensed at $49 for 31 days, $117 for 93 days, and $438 for a year, paid in cryptocurrency through vsell[.]io, and its builder and client are protected by more than one obfuscator including Agile.NET, Babel .NET, and SmartAssembly.
Why it matters: A single email campaign using doc00190910.exe accounted for over 1,800 of those attack sessions, and its C2 server had already been used across more than 50 Netwire, Nanocore, Quasar, and Remcos samples going back to early 2018 - the same infrastructure, a new tool.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026