Loading malware…
DRAT is a Windows remote access Trojan used in campaigns targeting Indian organizations. It supports reconnaissance, data exfiltration, additional payload upload, and persistent remote control for interactive and automated post-exploitation. DRAT V2 is a Delphi-compiled variant that succeeds an earlier .NET implementation and updates the malware's custom TCP-based, server-initiated command-and-control protocol.
DRAT V2 has been deployed by TAG-140, whose activity has been assessed to overlap with SideCopy, a group associated with Transparent Tribe. Observed delivery used a cloned Indian Ministry of Defense press-release portal and ClickFix-style social engineering to persuade victims to execute a malicious script through the Windows HTML Application host. This execution chain launched the BroaderAspect .NET loader, which established persistence and installed DRAT V2. Campaign targeting has included Indian government, defense, maritime, and academic organizations, as well as organizations affiliated with the railway, oil and gas, and external affairs ministries.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"
"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"
6 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Modified RAT used in campaigns targeting Indian government/defense/rail sectors (per summary).
Remote access trojan used to provide attackers interactive access/control over compromised systems (modified variant referenced as DRAT V2).
Remote access trojan used to maintain persistent control of infected systems; V2 updates a custom TCP-based, server-initiated C2 protocol and supports actions including data exfiltration, uploading additional payloads, and reconnaissance.
A RAT mentioned only as background context alongside other attacker tools.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.