Malicious actors are exploiting unsuspecting users by tricking them into running trojanized gaming utilities, which are distributed via browsers and chat platforms. The cybercriminals' goal is to spread a remote access trojan (RAT).
“A malicious downloader installed a portable Java runtime and executed a malicious Java archive (JAR) file named jd-gui.jar,” said in a post on X. “This downloader used PowerShell and living-off-the-land binaries (LOLBins), such as cmstp.exe, for stealth execution.”
See also: NuGet Gallery: Malicious Stripe package stole API Tokens
The attack chain is designed to evade detection by deleting the initial downloader and configuring exceptions in Microsoft Defender for the RAT components.
Persistence is achieved through a scheduled task and a Windows startup script named “world.vbs”, before the final payload is deployed to the compromised computer.
How does Java-Based RAT work?
The malware, according to Microsoft, is a “multi-purpose malware” that acts as a loader, runner, downloader, and RAT.
Once executed, it connects to an external server at “79.110.49[.]15” for command-and-control (C2) communications. This allows it to extract data and deploy additional payloads.
See also: Steaelite RAT: Data theft and ransomware in one tool
To protect against this threat, users are urged to exceptions Microsoft Defender and scheduled tasks, remove malicious tasks and startup scripts, isolate affected endpoints, and reset credentials for users active on compromised computers.
Tips for protecting against RAT malware
The first and most important way to protect against RAT malware is to install reliable security software. This software should include protection against viruses, spyware, malware, and other attacks, as well as the ability to detect and remove RATs.
Additionally, it is important to keep your operating system and all your applications up to date. These updates often include security patches that can protect your computer from the latest known trojans.
You should also be careful with emails and messages you receive. Many RAT malware are spread through phishing attacks, so avoid opening attachments or clicking on links from unknown sources.
See also: SURXRAT: The expansion of an LLM-based Trojan into Android Malware
Using strong passwords and changing them regularly can also help protect against RAT attacks. Also, using two-factor authentication can add an extra layer of security.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Finally, information security training can be particularly useful. Understanding the ways in which RAT malware invades your system and how to protect against them can help you stay safe.
