Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Cardinal RAT Active for Over Two Years

Summary: Palo Alto Networks' Unit 42 discovered a previously unknown remote access Trojan, Cardinal RAT, active for over two years with roughly 27 samples dating back to December 2015. It is delivered by a downloader called Carp, which uses malicious Microsoft Excel macros to compile embedded C# source code via the built-in csc.exe utility into an executable that downloads and runs Cardinal RAT, with 11 Carp Downloader samples observed and lures that are mostly financial-themed fake customer lists.

What you should know: Twenty-seven samples over two years kept this RAT under the radar, and its watchdog process re-sets the Load registry key and respawns the malware if either the key or the process is removed, so a single cleanup step will not hold.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related