MalwarePublished 31 Oct 2025

Tracking an evolving Discord-based RAT family

Source AlienVault OTX General

Description

A family of four new remote access trojans (RATs) operated by the STD Group has been identified, leveraging Discord as their command and control (C2) channel. These RATs—Minecraft RAT, UwUdisRAT, STD RAT, and Propionanilide RAT—are written in C++ and use a ROT23 cipher to obfuscate Discord bot tokens for C2 communication. The malware has evolved from single payloads to using packers, complicating detection efforts. The RATs enable attackers to perform reconnaissance, execute commands, and maintain persistence on infected systems. Detection is supported by YARA rules and file indicators provided in the analysis. While no known exploits in the wild have been reported yet, the use of Discord for C2 is notable for evading traditional network defenses. European organizations, especially those with high Discord usage or gaming-related sectors, could be targeted. Mitigation requires enhanced monitoring of Discord traffic, endpoint detection tuned for these RAT behaviors, and restricting unauthorized Discord bot usage within corporate environments.

Impact

For European organizations, this RAT family poses a significant risk due to its stealthy use of Discord for command and control, which can bypass traditional network security controls that do not inspect or restrict Discord traffic. Organizations in sectors with high Discord adoption—such as gaming, software development, and youth-oriented services—are particularly vulnerable. The RATs enable attackers to perform reconnaissance, steal credentials, execute arbitrary commands, and maintain persistence, potentially leading to data breaches, intellectual property theft, or disruption of services. The evolution to packed payloads increases the difficulty of detection by signature-based antivirus solutions. Additionally, the use of Discord, a widely trusted platform, complicates incident response and network monitoring. European entities with lax controls on third-party communication platforms or insufficient endpoint detection capabilities may face prolonged undetected intrusions. This threat could also be leveraged for espionage or sabotage, especially in organizations involved in technology, media, or critical infrastructure sectors.

Defensive guidance

European organizations should implement the following specific mitigations: 1) Enforce strict network segmentation and monitoring of Discord traffic, including the use of SSL/TLS inspection where legally permissible, to detect anomalous bot communication patterns. 2) Deploy endpoint detection and response (EDR) solutions configured to detect behaviors associated with these RATs, such as unusual process creation, use of packers, and suspicious API calls related to Discord bots. 3) Apply YARA rules and file indicators provided by ReversingLabs to enhance malware detection capabilities. 4) Restrict the installation and use of unauthorized Discord bots and clients within corporate environments through application whitelisting and group policies. 5) Educate users about the risks of executing unknown payloads, especially those related to gaming or Discord communities. 6) Regularly update and patch endpoint security tools to recognize new packing techniques and obfuscation methods. 7) Conduct threat hunting exercises focusing on Discord-based C2 traffic and related artifacts. 8) Collaborate with Discord platform providers to report suspicious bot activity and seek assistance in mitigating abuse. These measures go beyond generic advice by focusing on the unique use of Discord as a C2 channel and the malware’s evolving packing techniques.

Summary

ReversingLabs has uncovered a set of four remote access trojans (RATs) linked to the STD Group that utilize Discord as their command and control (C2) infrastructure. These RATs—Minecraft RAT, UwUdisRAT, STD RAT, and Propionanilide RAT—are developed in C++ and employ a ROT23 cipher to encode Discord bot tokens, which facilitates stealthy communication with their C2 servers hosted on Discord. The evolution of this malware family shows a progression from simple single payloads to more sophisticated variants that use packers, such as the Propionanilide RAT, to evade detection by antivirus and endpoint security solutions. The RATs leverage Discord’s legitimate API and infrastructure, making network-based detection challenging because Discord traffic is typically allowed in corporate environments. The malware supports a range of tactics including system reconnaissance (T1082, T1083, T1057), credential access (T1056), command execution (T1059.003), and persistence mechanisms (T1543.003). The use of ROT23 cipher for token obfuscation and the reliance on Discord bots for C2 communication are key technical features. The report includes YARA rules and file indicators to aid defenders in identifying infections. Although no active exploits have been reported, the threat is medium severity due to the potential for stealthy, persistent access and control over compromised systems. The malware’s use of a popular communication platform for C2 highlights the need for organizations to monitor and control Discord usage within their networks.

Indicators of compromise

Hashes 301

16f62ac70fce821c4dc6e178d7ff0ce4
1bb55cc26dc0904ddf0c2c0f6c56de20
25283b97624e5a25b8d45be7cec0edcb
25c095a512e9b58f07c8174c47a82535
275ef20b19ce085ad9a6f4555bc45947
2b0c0af9956928604aeb5884d888cb89
2b17e069dc77ec1ec65cac43cab37dde
2e0fc51860d7a2b72bc34410b956b303
310b0d940edd2fb9761e20ec08472c6d
326d523fd53f5d3b72fecdc1a6fb7574

Yara 2

3a11738952f549db5316f7f1c56f44977160496b
7020511e5c03b9203600175a9cf2829fa3e871f7

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Oct 2025, 11:25 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Hashes 301

Yara 2

Community reviews

Related threats