MalwarePublished 9 Sep 2025

MostereRAT Deployed AnyDesk/TightVNC for Covert Full Access

Source AlienVault OTX General

Description

A sophisticated phishing campaign targeting Japanese users employs MostereRAT, a Remote Access Trojan that utilizes advanced evasion techniques. The attack chain involves multiple stages, including an Easy Programming Language (EPL) payload, security tool disabling, and mTLS-secured C2 communications. The malware can deploy popular remote access tools like AnyDesk and TightVNC, granting attackers full system control. It employs techniques such as running as TrustedInstaller, blocking AV traffic, and creating hidden administrator accounts. The campaign's complexity and use of legitimate tools make detection and prevention challenging, highlighting the importance of user education and up-to-date security solutions.

Impact

For European organizations, the deployment of MostereRAT represents a significant risk to confidentiality, integrity, and availability of systems. The malware’s ability to gain TrustedInstaller privileges and create hidden administrator accounts means attackers can fully control infected systems, potentially leading to data exfiltration, intellectual property theft, sabotage, or ransomware deployment. The use of legitimate remote access tools like AnyDesk and TightVNC complicates detection and may allow attackers to move laterally within networks undetected. European organizations with remote workforce setups or those using AnyDesk/TightVNC for legitimate purposes could be particularly vulnerable. The phishing vector also means that organizations with less mature user training and email filtering are at higher risk. While the campaign currently targets Japanese users, the techniques and tools used could be adapted or spread to Europe, especially given the global use of the affected remote access tools. The encrypted mTLS communication channel further complicates network monitoring and intrusion detection, increasing the likelihood of prolonged undetected compromise.

Defensive guidance

1. Implement advanced email filtering solutions that use machine learning and threat intelligence to detect and block phishing emails, especially those containing EPL payloads or suspicious attachments. 2. Enforce strict application whitelisting and restrict execution of uncommon scripting languages like EPL unless explicitly required. 3. Monitor for unusual privilege escalations, especially processes running as TrustedInstaller, and alert on creation of hidden administrator accounts. 4. Use endpoint detection and response (EDR) tools capable of behavioral analysis to detect the use of legitimate remote access tools in suspicious contexts, such as AnyDesk or TightVNC launched by unknown or unauthorized processes. 5. Employ network segmentation to limit lateral movement opportunities if a system is compromised. 6. Monitor network traffic for mTLS connections to unusual or suspicious domains listed in the indicators (e.g., huanyu3333.com, mostere.com) and block or investigate accordingly. 7. Conduct regular user awareness training focused on phishing threats and the risks of enabling remote access tools. 8. Maintain up-to-date security patches and endpoint protection solutions that can detect and block known hashes and indicators associated with MostereRAT. 9. Implement strict access controls and multi-factor authentication (MFA) for remote access tools to prevent unauthorized use. 10. Regularly audit and review administrator accounts and privileges to detect unauthorized additions or changes.

Indicators of compromise

Domains 7

huanyu3333.com
idkua93dkh9590764478t18822056bck.com
mostere.com
osjfd923bk78735547771x3690026ddl.com
xxxxxx25433693728080140850916444.com
zzzzzzz0379098305467195353458278.com
www.efu66.com

Hashes 7

a9b52f654370a25d25af4554c25c2cc9
7065ec1c8d8cccf6be22d21f781e278f307720ad
3c621b0c91b758767f883cbd041c8ef701b9806a78f2ae1e08f932b43fb433bb
4e3cdeba19e5749aa88329bc3ac67acd777ea7925ba0825a421cada083706a4e
546a3418a26f2a83a2619d6c808985c149a0a1e22656553ce8172ca15622fd9b
926b2b9349dbd4704e117304c2f0edfd266e4c91fb9325ecb11ba83fe17bc383
d281e41521ea88f923cf11389943a046557a2d73c20d30b64e02af1c04c64ed1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Sep 2025, 11:40 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 7

Hashes 7

Community reviews

Related threats