Related Families: Mandibule, Cobalt Strike, Trochilus, RedLeaves
Verticals Targeted: Government
Related Families: ALPHV
Executive Summary
Fin8 was observed leveraging Sardonic backdoor to deliver ALPHV ransomware.
Related Families: Ketrican, BS2005
Verticals Targeted: Government, Financial
Executive Summary
Vixen Panda was recently observed using the Graphican backdoor to target government, financial, and other entities in the Americas and Europe. It is based on Ketrican and is one of many tools in Vixen Panda’s arsenal.
Executive Summary
Zscaler recently reported on WarHawk, a new backdoor used by the Indian threat actor group SideWinder.
Related Families: Specter RAT, SideWalk (Windows)
Verticals Targeted: Education
Executive Summary
ESET recently reported on a SideWalk Linux variant. SideWalk is a backdoor used by the SparklingGoblin threat actor group.
Executive Summary
Kaspersky recently reported on SessionManager, a difficult to detect backdoor targeting governments and NGOs in multiple countries.
Background
Cyble recently published research on Borat RAT, a triple threat capable of providing backdoor access, facilitating spyware capabilities, and conducting DDoS and ransomware attacks. This emerging threat can be used to perform double and triple extortion attacks, where threat actors demand ransom and also threaten victims with the sale or leak of stolen data and DDoS attacks.
What is Borat RAT?
Borat RAT is a remote access trojan with extended capabilities allowing threat actors to spy on victims and conduct DDoS attacks and ransomware attacks. It is being sold on the underground and is advertised to have multiple features, allowing threat actors to tailor their attacks to a particular victim.
According to Cyble, Borat RAT comes as a package including a builder binary, supporting modules, and a server certificate. Threat actors have the option to compile the binary to perform DDoS and ransomware attacks.
Borat RAT has a number of features allowing threat actors to spy on and troll victims and to evade detection and maintain persistence. Its spyware features allow threat actors to recover saved Chrome and Edge browser passwords and Discord passwords. Other spyware features include keylogging, audio recording, and webcam recording.
Borat RAT has remote hVNC capabilities, such as hidden desktop and hidden browsers. It is advertised as having “remote fun” options allowing threat actors to troll or intimidate victims by turning peripherals on and off, enabling and disabling TaskMgr and Regedit, and showing or hiding the Start button. Borat RAT’s remote system options allow the threat actor to use remote shell, TCP, reverse proxy, etc. Borat RAT also includes features allowing a threat actor to evade detection and maintain persistence.
IOCs
PolySwarm has a sample of Borat RAT.
b47c77d237243747a51dd02d836444ba067cf6cc4b8b3344e5cf791f5f41d20e
You can use the following CLI command to search for all Borat RAT samples in our portal: