Monetary establishments like buying and selling and brokerage corporations are the goal of a brand new marketing campaign that delivers a beforehand unreported distant entry trojan referred to as GodRAT.
The malicious exercise entails the “distribution of malicious .SCR (display screen saver) information disguised as monetary paperwork through Skype messenger,” Kaspersky researcher Saurabh Sharma stated in a technical evaluation revealed as we speak.
The assaults, which have been lively as lately as August 12, 2025, make use of a method referred to as steganography to hide inside picture information shellcode used to obtain the malware from a command-and-control (C2) server. The display screen saver artifacts have been detected since September 9, 2024, focusing on nations and territories like Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan.
Assessed to be based mostly on Gh0st RAT, GodRAT follows a plugin-based method to reinforce its performance in an effort to harvest delicate info and ship secondary payloads like AsyncRAT. It is price mentioning that Gh0st RAT had its supply code leaked publicly in 2008 and has since been adopted by numerous Chinese language hacking teams.
The Russian cybersecurity firm stated the malware is an evolution of one other Gh0st RAT-based backdoor generally known as AwesomePuppet that was first documented in 2023 and is probably going believed to be the handiwork of the prolific Chinese language menace actor, Winnti (aka APT41).
The display screen saver information act as a self-extracting executable incorporating numerous embedded information, together with a malicious DLL that is sideloaded by a legit executable. The DLL extracts shellcode hidden inside a .JPG picture file that then paves the best way for the deployment of GodRAT.
The trojan, for its half, establishes communication with the C2 server over TCP, collects system info, and pulls the listing of put in antivirus software program on the host. The captured particulars are despatched to the C2 server, after which the server responds with follow-up directions that enable it to –
- Inject a obtained plugin DLL into reminiscence
- Shut the socket and terminate the RAT course of
- Obtain a file from a supplied URL and launch it utilizing the CreateProcessA API
- Open a given URL utilizing the shell command for opening Web Explorer
One of many plugins downloaded by the malware is a FileManager DLL that may enumerate the file system, carry out file operations, open folders, and even run searches for information at a specified location. The plugin has additionally been used to ship extra payloads, equivalent to a password stealer for Google Chrome and Microsoft Edge browsers and the AsyncRAT trojan.
Kaspersky stated it found the whole supply code for the GodRAT consumer and builder that was uploaded to the VirusTotal on-line malware scanner in late July 2024. The builder can be utilized to generate both an executable file or a DLL.
When the executable choice is chosen, customers have the selection of choosing a legit binary from a listing to which the malicious code is injected into: svchost.exe, cmd.exe, cscript.exe, curl.exe, wscript.exe, QQMusic.exe and QQScLauncher.exe. The ultimate payload may be saved with one of many following file varieties: .exe, .com, .bat, .scr, and .pif.
“Previous implant codebases, equivalent to Gh0st RAT, that are almost twenty years outdated, proceed for use as we speak,” Kaspersky stated. “These are sometimes custom-made and rebuilt to focus on a variety of victims.”
“These outdated implants are recognized to have been utilized by numerous menace actors for a very long time, and the GodRAT discovery demonstrates that legacy codebases like Gh0st RAT can nonetheless keep an extended lifespan within the cybersecurity panorama.”
