DslogdRAT

DslogdRAT is a remote access trojan observed in intrusions involving Ivanti Connect Secure appliances. It has been deployed after exploitation of the critical Ivanti Connect Secure vulnerability CVE-2025-0282, including zero-day activity targeting organizations in Japan beginning in late 2024. In reported attack chains, adversaries first installed a Perl web shell on the compromised appliance and then used it to deliver DslogdRAT as a follow-on payload.

Once active, DslogdRAT establishes a socket-based connection to attacker-controlled infrastructure, transmits basic host information, and awaits tasking. Its supported functions include remote shell command execution, file upload and download, and proxying network traffic through the infected system. These capabilities make it suitable for sustained post-compromise access and operator-driven follow-on activity.

DslogdRAT has been discussed alongside other malware families used in exploitation of Ivanti Connect Secure flaws, including SPAWNCHIMERA and related SPAWN ecosystem components. Reporting has linked the broader exploitation of these Ivanti vulnerabilities to China-nexus intrusion activity, but available information does not conclusively attribute DslogdRAT itself to the same specific campaign or actor cluster. The malware is associated with attacks against organizations using Ivanti Connect Secure, affecting both private-sector and government environments.