MalwarePublished 21 Jul 2025

DeedRAT Backdoor Enhanced with Advanced Capabilities

Source AlienVault OTX General

Description

Chinese threat actors have launched a new phishing campaign using DeedRAT, a modular backdoor. The campaign exploits a DLL side-loading vulnerability in VIPRE Antivirus Premium's MambaSafeModeUI.exe. DeedRAT now includes a new NetAgent module, expanding its capabilities. The malware uses TCP for C2 communication and employs various persistence techniques. Notable features include a custom encryption algorithm using a linear congruential generator, API protection, and junk functions to confuse analysts. The backdoor's continued development and increased obfuscation suggest the threat actors are actively enhancing their tools and techniques.

Impact

European organizations face significant risks from this threat due to the targeted exploitation of VIPRE Antivirus Premium, a security product that may be deployed in various enterprises. Successful compromise could lead to unauthorized remote access, data exfiltration, espionage, and potential lateral movement within networks. The use of phishing as an initial vector increases the likelihood of infection, especially in organizations with insufficient user awareness or email security controls. The modular nature of DeedRAT and its new NetAgent module allow attackers to tailor payloads and commands, potentially enabling espionage or sabotage against critical infrastructure, government entities, or private sector companies. The exploitation of antivirus software undermines trust in endpoint protection, complicating detection and response efforts. Persistence mechanisms and anti-analysis features further increase the difficulty of eradication. Given the involvement of Chinese APT groups, the threat may be strategically motivated, targeting intellectual property, sensitive communications, or infrastructure relevant to European geopolitical interests.

Defensive guidance

1. Immediately assess and inventory the deployment of VIPRE Antivirus Premium within the organization. If present, monitor for updates or advisories from the vendor regarding the DLL side-loading vulnerability and apply patches as soon as they become available. 2. Implement advanced email security solutions with phishing detection and sandboxing to reduce the risk of initial infection via phishing campaigns. 3. Employ network monitoring to detect anomalous TCP traffic patterns consistent with DeedRAT's C2 communications, including traffic to suspicious domains such as 'luckybear669.kozow.com'. 4. Use endpoint detection and response (EDR) tools capable of identifying DLL side-loading attempts, suspicious service creations, and code injection behaviors. 5. Conduct regular threat hunting exercises focusing on indicators of compromise such as the provided file hashes and domain names. 6. Enhance user training programs to increase awareness of phishing threats and suspicious attachments or links. 7. Restrict execution privileges and enforce application whitelisting to prevent unauthorized DLL loading and execution of unknown binaries. 8. Monitor and audit persistence mechanisms, including service registrations and registry modifications, to detect unauthorized changes. 9. Collaborate with threat intelligence sharing communities to stay updated on emerging variants and tactics related to DeedRAT.

Indicators of compromise

Domains 1

luckybear669.kozow.com

Hashes 3

52f489d47618db8dfb503d6da98cbd76d08b063cc7ce0aac02b03601b6cae6a1
99a0b424bb3a6bbf60e972fd82c514fd971a948f9cedf3b9dc6b033117ecb106
e356dbd3bd62c19fa3ff8943fc73a4fab01a6446f989318b7da4abf48d565af2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Jul 2025, 11:01 UTC

MITRE ATT&CK techniques16 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 3

Community reviews

Related threats