Threats Tagged 'rat'

A sophisticated supply chain attack uses typosquatting on the popular postcss-selector-parser npm package to distribute a multi-stage Windows Remote Access Trojan (RAT). Malicious packages masquerade as PostCSS utilities and deploy encoded JavaScript that drops PowerShell scripts. These scripts download a bundled Python runtime with Nuitka-compiled modules, culminating in a RAT with capabilities such as encrypted HTTP C2 communication, persistence, VM detection, remote shell, file transfer, and Chrome credential theft via DPAPI. This attack highlights risks in build tooling dependencies as malware delivery vectors targeting developer environments.

SideCopy, also tracked as APT36 or Transparent Tribe, has launched a new attack campaign targeting Indian defense personnel using a fake 'Minutes Of Meeting' document as lure. The attack employs an identical playbook to previous operations: a double-extension Minutes Of Meeting.docx.lnk file executes a PowerShell stager (pdfdocs.bat) from a nested pdfdocs folder while displaying a clean decoy document. The chain deploys a Remote Access Trojan (pdfdocs) that establishes persistence through the HKCU Run key. The staged components demonstrate low detection rates at initial delivery, with the decoy document scoring 0/66, the stager 1/61, and only the final executable reaching 35/71 detections.

MediumMalwareBritish Indian Ocean TerritoryIndia#rat#indian defense targeting#double extension

Through April 2026, Kimsuky deployed sophisticated malicious campaigns against South Korean military and corporate entities using tailored social engineering tactics including fake security software installation pages and spoofed Webex meeting pages leveraging legitimate meeting schedules. The threat actor introduced a novel JSONPing technique allowing distribution pages to verify in real time whether victims executed the payload via JSONP queries to localhost servers. Analysis revealed a new HttpSpy variant with a three-stage execution chain replacing the previous single-binary architecture, utilizing RC4 encryption and shared infrastructure indicators. Attribution was confirmed through code pattern overlaps, reused encryption keys, XAMPP certificate fingerprints, and preferred ASN usage consistent with historical Kimsuky operations targeting South Korea.

MediumMalwareSouth Korea#spear phishing#httpspy#webex spoofing