Threats Tagged 'crysome rat'

This threat involves a sophisticated multi-stage infection chain delivering the CrySome remote access trojan (RAT) via spear-phishing with a logistics rate confirmation lure. The attack uses living-off-the-land techniques, including UAC bypass via the ICMLuaUtil COM interface and in-memory AMSI patching, to evade detection. An open-source tool, WinDefCtl, is employed to disrupt Windows Defender protections before deploying the final payload. CrySome RAT establishes persistence through scheduled tasks and enables attackers to perform hidden VNC access, remote command execution, system reconnaissance, and credential theft from Chromium-based browsers. The campaign highlights the use of publicly available tools combined with legitimate Windows processes to minimize detection and achieve full system compromise.