VERMIN: Quasar RAT and Custom Malware Used In Ukraine
Summary: Palo Alto Networks Unit 42 documented a malware family it calls VERMIN, a .NET remote access tool written largely as original code and used alongside the open-source Quasar RAT in a campaign dating to late 2015. Nearly all targeting uncovered related to Ukraine, including a sample using a Ukrainian Ministry of Defense-themed decoy document, and VERMIN communicates over HTTP-encapsulated SOAP while logging keystrokes and clipboard data encrypted with a hardcoded 3-DES key.
Key Takeaway: Unit 42 could not determine what data was stolen, but the campaign's Ukraine-focused lures and hands-on-keyboard operation point to targeted intrusions rather than opportunistic crime, and the same actor appears to be the sole user of VERMIN.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026