Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Orcus – Birth of an unusual plugin builder RAT

Summary: Unit 42 has tracked a Remote Access Trojan called Orcus, sold for $40 USD since April 2016, which lets users build custom plugins and uses a modular architecture. The developer, using the alias "Sorzus", first posted about the tool as "Schnorchel" around October 2015, and with partner "Armada" now manages its sales and development, with the RAT written in C# and controlled through a separate Orcus controller component.

What you should know: At $40 with a documented plugin system, a GitHub page of sample plugins, and an Android controller app on Google Play, Orcus lowers the bar for building custom malware to anyone with basic C#, VB.Net or C++ knowledge. Its separate controller-and-server design also lets a group of criminals share access to one infected network, so a single intrusion can scale across operators.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related