Loading threat actor…
FatalRAT is a remote access trojan associated with Chinese state-sponsored intrusion activity targeting government and corporate networks in the Asia-Pacific region. It has been observed in espionage-oriented campaigns and is linked to operations against APAC organizations. Reported tradecraft includes DLL sideloading, anti-virtual-machine checks prior to execution, abuse of legitimate remote administration software for remote control, and propagation within victim environments by brute-forcing weak passwords over Windows administrative shares and remotely executing copied payloads. Activity involving FatalRAT has also been accompanied by other remote access malware families including Gh0st RAT and Simay RAT. The malware’s use by Chinese state-sponsored actors and its focus on government and enterprise victims indicate an intelligence-collection mission rather than financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-espionage operations in APAC using multiple RATs and DLL sideloading techniques.
Cyber-espionage operations in APAC using multiple RATs and DLL sideloading techniques.
Remote access trojan that checked for virtual machines before execution, uninstalled UltraViewer, installed AnyDesk, and spread laterally by brute-forcing weak passwords over IPC$.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.