Investigating the Luminosity Link Remote Access Trojan Configuration
Summary: Unit 42 researchers reverse-engineered the LuminosityLink RAT, a $40 system-administration utility that functions as a keylogger and backdoor, and determined its embedded configuration is encrypted with AES-128 using an MD5-hashed key derived from a reversed registry path string. Applying their parsing script to roughly 18,000 collected samples, they extracted 14,700 configurations, and Palo Alto Networks reports tracking approximately 50,000 attempted LuminosityLink infections against its customers since the malware first surfaced in May 2015.
What's compelling: The extracted configurations reveal the hosts and ports each sample is set to communicate with, giving defenders concrete indicators from a tool that has been sold openly for $40 and used in roughly 50,000 attempted infections.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026