MalwarePublished 10 Oct 2025Updated 9 Nov 2025

A Vietnamese threat actor's shift from PXA Stealer to PureRAT

Source AlienVault OTX General

Description

A Vietnamese threat actor has transitioned from using the PXA Stealer to deploying PureRAT, a commercial remote access trojan. The attack chain involves multiple stages, including phishing emails, Python-based infostealers, and .NET loaders. The campaign demonstrates a progression in complexity, utilizing DLL sideloading, obfuscation techniques, and defense evasion methods. The final payload, PureRAT, provides the attacker with extensive control over compromised systems. The threat actor's shift to commodity malware indicates a maturing operation, lowering the barrier for sophisticated attacks. This evolution highlights the need for robust, multi-layered defense strategies to counter such adaptable threats.

Impact

For European organizations, the deployment of PureRAT via phishing and multi-stage infection chains can lead to significant confidentiality breaches through data theft and espionage. The RAT’s extensive control capabilities enable attackers to manipulate system integrity and potentially disrupt availability through lateral movement or destruction of data. Sectors such as finance, government, healthcare, and critical infrastructure are particularly vulnerable due to the value of their data and the potential for operational disruption. The use of DLL sideloading and obfuscation complicates detection, increasing dwell time and the risk of prolonged compromise. The shift to commodity malware lowers the skill threshold, potentially increasing the volume and diversity of attacks targeting European entities. This could result in financial losses, reputational damage, regulatory penalties under GDPR, and national security concerns. The medium severity reflects the balance between the complexity of the attack chain and the requirement for user interaction (phishing) to initiate the infection.

Defensive guidance

1. Implement advanced phishing defenses including user training, email filtering, and sandboxing to detect and block malicious attachments and links. 2. Deploy endpoint detection and response (EDR) solutions capable of identifying DLL sideloading and process injection behaviors. 3. Monitor for unusual network traffic patterns, especially connections to known malicious IPs such as 157.66.26.209. 4. Enforce application whitelisting and restrict execution of unauthorized scripts and binaries, particularly Python and .NET loaders. 5. Regularly update and patch all software to reduce attack surface, even though no specific CVEs are noted, to mitigate exploitation of potential vulnerabilities. 6. Utilize threat intelligence feeds to update detection rules with the provided file hashes and indicators of compromise. 7. Implement multi-factor authentication to limit attacker lateral movement post-compromise. 8. Conduct regular incident response exercises to prepare for detection and containment of RAT infections. 9. Employ network segmentation to limit the spread of malware within organizational networks. 10. Review and harden security controls around DLL loading paths to prevent sideloading attacks.

Indicators of compromise

IP addresses 1

157.66.26.209

Hashes 3

06fc70aa08756a752546198ceb9770068a2776c5b898e5ff24af9ed4a823fd9d
f5e9e24886ec4c60f45690a0e34bae71d8a38d1c35eb04d02148cdb650dd2601
f6ed084aaa8ecf1b1e20dfa859e8f34c4c18b7ad7ac14dc189bc1fc4be1bd709

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Oct 2025, 08:51 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 3

Community reviews

Related threats