MalwarePublished 31 Dec 2025Updated 2 Jan 2026

DeedRAT: Unpacking a Modern Backdoor's Playbook

Source AlienVault OTX General

Description

DeedRAT is a sophisticated backdoor associated with the Chinese APT group Salt Typhoon, targeting critical sectors globally. It infiltrates systems through phishing campaigns, utilizing DLL sideloading to evade detection. The malware establishes persistence via registry run keys and service creation, ensuring long-term access. DeedRAT's capabilities include file manipulation, system reconnaissance, and payload execution. The infection chain involves three files: a legitimate executable, a malicious DLL, and an encrypted file. Once installed, it attempts to connect to its command-and-control server. Defensive measures include monitoring email traffic, registry changes, and anomalous service creations.

Impact

For European organizations, especially those operating in critical sectors such as energy, finance, telecommunications, and government, DeedRAT presents a serious threat. The malware's stealthy infection vector via phishing and DLL sideloading can lead to undetected long-term access, enabling espionage, intellectual property theft, and potential sabotage. Persistent access allows attackers to manipulate files, gather sensitive system information, and deploy further malicious payloads, potentially disrupting operations or exfiltrating confidential data. The presence of encrypted payloads complicates detection and forensic analysis, increasing response times and damage scope. Given the malware's association with a state-sponsored APT, targeted attacks could be highly tailored, focusing on strategic European infrastructure and organizations. This could undermine national security, economic stability, and public trust. The medium severity rating reflects the balance between the required user interaction (phishing) and the high potential impact of successful compromise. Organizations lacking robust email security, endpoint monitoring, and incident response capabilities are particularly vulnerable.

Defensive guidance

European organizations should implement multi-layered defenses tailored to DeedRAT's tactics. First, enhance phishing detection by deploying advanced email filtering solutions that analyze attachments and links for malicious content, and conduct regular user awareness training focused on phishing risks. Second, implement strict application whitelisting and DLL loading policies to prevent unauthorized DLL sideloading, including monitoring for unexpected DLL loads by legitimate executables. Third, continuously monitor Windows registry keys related to run keys and service creation for unauthorized modifications, using endpoint detection and response (EDR) tools capable of alerting on suspicious persistence mechanisms. Fourth, employ network monitoring to detect anomalous outbound connections, especially to known malicious domains such as 'luckybear669.kozow.com', and block or quarantine suspicious traffic. Fifth, maintain up-to-date backups and incident response plans to quickly recover from potential compromises. Finally, conduct threat hunting exercises using the provided file hashes and indicators of compromise (IOCs) to identify and remediate infections proactively. Collaboration with national cybersecurity centers and sharing threat intelligence can enhance detection and response capabilities.

Indicators of compromise

Domains 1

luckybear669.kozow.com

Hashes 10

06ca939eac30e7f1d789a9bd26586173MD5 of 52f489d47618db8dfb503d6da98cbd76d08b063cc7ce0aac02b03601b6cae6a1
2561b457103e7e74f5e6d9dcf703bfe6MD5 of 99a0b424bb3a6bbf60e972fd82c514fd971a948f9cedf3b9dc6b033117ecb106
96e3e845220da6795096bc37e3f82d6aMD5 of e356dbd3bd62c19fa3ff8943fc73a4fab01a6446f989318b7da4abf48d565af2
0cd284f5e206972c66ba0eafe7a698fe7e9fc751SHA1 of e356dbd3bd62c19fa3ff8943fc73a4fab01a6446f989318b7da4abf48d565af2
4ea5734e235b2a00dc91babb5131681f702016b1SHA1 of 52f489d47618db8dfb503d6da98cbd76d08b063cc7ce0aac02b03601b6cae6a1
bcde791850b3a547aee585ea8c8bf060b16512a9SHA1 of 99a0b424bb3a6bbf60e972fd82c514fd971a948f9cedf3b9dc6b033117ecb106
2d9107edad9f674f6ca1707d56619a355227a661163f18b5794326d4f81a2803
52f489d47618db8dfb503d6da98cbd76d08b063cc7ce0aac02b03601b6cae6a1
99a0b424bb3a6bbf60e972fd82c514fd971a948f9cedf3b9dc6b033117ecb106
e356dbd3bd62c19fa3ff8943fc73a4fab01a6446f989318b7da4abf48d565af2

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Jan 2026, 11:14 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 10

Community reviews

Related threats