MalwarePublished 10 Sep 2025Updated 10 Oct 2025

ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RAT

Source AlienVault OTX General

Description

ZynorRAT is a newly discovered Go-based Remote Access Trojan that provides a full suite of command and control capabilities for Linux and Windows systems. It was first identified in July 2025 and is believed to be of Turkish origin. The malware uses Telegram as its C2 infrastructure and offers features such as file exfiltration, system enumeration, screenshot capture, persistence through systemd services, and arbitrary command execution. The Linux version is fully functional, while the Windows version appears to be in early development. The malware's author seems to be actively working on improving its detection avoidance. ZynorRAT's capabilities include discovery, exfiltration, persistence, and remote code execution on victim machines.

Impact

For European organizations, ZynorRAT poses a significant threat primarily to Linux-based infrastructure, which is widely used in enterprise environments, cloud services, and critical infrastructure sectors. The malware’s ability to exfiltrate sensitive files and execute arbitrary commands can lead to data breaches, intellectual property theft, and operational disruption. Persistence via systemd services complicates remediation efforts, potentially allowing prolonged unauthorized access. The use of Telegram for C2 communications may bypass conventional network security controls, increasing the risk of undetected lateral movement and espionage. Although the Windows variant is less mature, its development indicates a future expansion of the threat to Windows endpoints, broadening the attack surface. European organizations in sectors such as finance, manufacturing, telecommunications, and government are particularly at risk due to their reliance on Linux servers and the strategic value of their data. The medium severity rating reflects the current limited deployment and lack of widespread exploitation but does not diminish the potential for escalation. The threat also underscores the need for vigilance against novel malware leveraging legitimate platforms for C2, which can evade traditional detection mechanisms.

Defensive guidance

To mitigate the risk posed by ZynorRAT, European organizations should implement targeted measures beyond generic best practices: 1) Monitor and restrict Telegram traffic within enterprise networks, employing deep packet inspection and behavioral analysis to detect anomalous usage patterns indicative of C2 communications. 2) Harden Linux systems by auditing and restricting systemd service creation and modifications, employing file integrity monitoring to detect unauthorized persistence mechanisms. 3) Deploy endpoint detection and response (EDR) solutions capable of identifying Go-based malware behaviors, including unusual process executions, file access patterns, and network connections to Telegram endpoints. 4) Conduct regular threat hunting exercises focusing on indicators of compromise related to system enumeration, screenshot capture, and file exfiltration activities. 5) Enforce strict access controls and segmentation to limit lateral movement opportunities if an infection occurs. 6) Maintain up-to-date backups and incident response plans tailored to handle advanced persistent threats with stealthy persistence. 7) Educate security teams on emerging threats leveraging legitimate communication platforms for C2 to improve detection and response capabilities. 8) Collaborate with threat intelligence sharing communities to stay informed about developments in ZynorRAT’s capabilities and deployment.

Indicators of compromise

Domains 1

network.target

IP addresses 37

102.129.152.199
136.144.33.64
213.33.190.191
79.104.209.144
136.144.33.66
140.228.21.191
154.61.71.50
176.238.224.71
176.88.126.219
178.244.44.146

Hashes 24

073ea1d3dcbe5d9522051e1a085ed5b7
156195fa921d14a24d3b61239db14d28
1d825e867cb0f409dc15d7444d475e86
7422122eec7cfb3ec44737607d3ff5d2
780f1447be2e88e72067ed2e66f51256
7a97e01b8ef206f5dce592ff68442e1e
be3d985a4a76dfeaf485955c1ef67249
0028560839604fd4f2abda139d3752c8ee12b360
170d031cf7436bc2a4d2d2fabf7d09c61074f1a1
2e3b81497f6cb06c91b2e60753340db84d09e378

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Sep 2025, 08:30 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

IP addresses 37

Hashes 24

Community reviews

Related threats