Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments
Summary: Unit 42 reported that attacks it attributes to the DustySky campaign, which others have linked to the Gaza Cybergang group targeting government interests in the region, install the Downeks downloader, which in turn infects victims with the Quasar RAT. The attackers modified the open-source .NET Quasar RAT and its server and used an obfuscator and packer to hide the tool, and Unit 42 observed Quasar being blocked on a Traps-protected client in September 2016.
Bottom line: The attackers' own Quasar command-and-control server was found vulnerable to remote code execution, meaning a second attacker could install their own RAT on it - a reminder that the infrastructure behind these government-targeting intrusions is itself exposed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026