CampaignPublished 24 Feb 2026Updated 26 Mar 2026

Moonrise RAT: A New Low-Detection Threat with High-Cost Consequences

Source AlienVault OTX General

Description

A new Go-based remote access trojan named Moonrise has been discovered, operating without early static detection and establishing active C2 communication before vendor alerts. The RAT supports credential theft, remote command execution, persistence, and user monitoring, enabling full remote control of infected endpoints. Its capabilities include stealing passwords, executing remote commands, uploading files, capturing screens, and accessing webcams and microphones. The malware's silent operation increases business exposure, extending dwell time and raising risks of data loss and operational disruption. The attack chain involves session registration, host environment visibility, direct system interaction, credential access, active user monitoring, and privilege manipulation. Early detection strategies involve monitoring for weak signals, rapid triage with behavior confirmation, and threat hunting to prevent repeat incidents.

Impact

The Moonrise RAT poses a significant threat to organizations by enabling attackers to gain full remote control over infected systems, leading to extensive data breaches, credential theft, and espionage. Its ability to capture screens, record audio and video, and execute arbitrary commands can result in severe operational disruptions and loss of sensitive intellectual property. The stealthy nature of the RAT increases dwell time, allowing attackers prolonged access to networks, which can facilitate lateral movement and further compromise. Organizations may face financial losses due to remediation costs, regulatory penalties from data breaches, and reputational damage. The RAT’s credential theft capabilities can also enable attackers to escalate privileges and access additional systems, compounding the impact. Given its low detection rate and advanced persistence mechanisms, Moonrise RAT infections can be difficult to eradicate, increasing the risk of repeated incidents and long-term exposure.

Defensive guidance

To effectively mitigate Moonrise RAT, organizations should implement a multi-layered defense strategy focused on early detection and rapid response. Specific recommendations include: 1) Deploy advanced endpoint detection and response (EDR) solutions capable of behavioral analysis to identify anomalous activities such as unusual process executions, privilege escalations, and unauthorized access to webcams or microphones. 2) Monitor network traffic for early-stage C2 communication patterns, including connections to known malicious IP addresses like 193.23.199.88, and implement network segmentation to limit lateral movement. 3) Conduct regular threat hunting exercises focusing on weak signals such as unexpected session registrations, host environment queries, and suspicious file uploads/downloads. 4) Enforce strict credential hygiene by implementing multi-factor authentication (MFA), regularly rotating passwords, and monitoring for credential dumping attempts. 5) Harden systems by applying the principle of least privilege and disabling unnecessary services that could be exploited for persistence. 6) Educate users about social engineering and phishing tactics that may be used to deliver the RAT. 7) Maintain comprehensive logging and enable rapid triage workflows to confirm and respond to behavioral alerts promptly. 8) Utilize threat intelligence feeds to update detection rules with indicators of compromise such as the provided file hashes. These targeted measures go beyond generic advice and address the RAT’s stealth and persistence capabilities directly.

Indicators of compromise

IP addresses 1

193.23.199.88

Hashes 6

082fdd964976afa6f9c5d8239f74990b24df3dfa0c95329c6e9f75d33681b9f4
7609c7ab10f9ecc08824db6e3c3fa5cbdd0dff2555276e216abe9eebfb80f59b
8a422b8c4c6f9a183848f8d3d95ace69abb870549b593c080946eaed9e5457ad
8d7c1bbdb6a8bf074db7fc1185ffd59af0faffb08e0eb46a373c948147787268
c7fd265b23b2255729eed688a211f8c3bd2192834c00e4959d1f17a0b697cd5e
ed5471d42bef6b32253e9c1aba49b01b8282fd096ad0957abcf1a1e27e8f7551

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Feb 2026, 20:46 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 6

Community reviews

Related threats