DRAT
DRAT is a remote access trojan (RAT) used in campaigns attributed by Recorded Future’s Insikt Group to TAG-140, an activity cluster assessed to overlap with SideCopy, an operational subgroup or affiliate of Transparent Tribe, a suspected Pakistani state-aligned APT. In the reported campaign, TAG-140 targeted Indian government organizations and also entities associated with India’s railway, oil and gas, and external affairs ministries, with researchers noting expansion beyond government, defense, maritime, and academic sectors. The intrusion chain used a spoofed Indian Ministry of Defense press release portal and a ClickFix-style social engineering lure, with suspected spear-phishing used for delivery. Victims were induced to execute a malicious script via mshta.exe, which launched the BroaderAspect .NET loader; BroaderAspect then established persistence and installed and executed DRAT V2. DRAT V2 reflects a transition from an earlier .NET-based DRAT to a Delphi-compiled variant. The newer version uses an updated custom TCP-based, server-initiated command-and-control protocol and provides expanded capabilities including data exfiltration, payload upload, and reconnaissance. Researchers stated these functions support persistent and flexible control as well as automated and interactive post-exploitation without auxiliary tools. The malware reportedly uses basic infection and persistence methods and is detectable through static and behavioral analysis. High-confidence behavioral indicators from the reporting include execution via mshta.exe, use of the BroaderAspect loader, spoofed Ministry of Defense infrastructure, and deployment of DRAT V2 in TAG-140 operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"
"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"The threat group gains initial access to a victim's device through what Insikt Group considers to be a ClickFix-style social engineering lure... they suspect the attackers used spear-phishing emails."
Stealth
1 technique"Victims were enticed to execute a malicious script via mshta.exe, which led to the execution of the BroaderAspect .NET loader"
Discovery
1 techniqueCommand and Control
2 techniques"Version 2 of DRAT updates the custom TCP-based, server-initiated command-and-control protocol"
Exfiltration
1 technique"The malware's other capabilities allow it to perform a wide variety of actions, such as exfiltrating data"
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modified RAT used in campaigns targeting Indian government/defense/rail sectors (per summary).
Remote access trojan used to provide attackers interactive access/control over compromised systems (modified variant referenced as DRAT V2).
Remote access trojan used to maintain persistent control of infected systems; V2 updates a custom TCP-based, server-initiated C2 protocol and supports actions including data exfiltration, uploading additional payloads, and reconnaissance.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.