Skip to main content
Mallory
MalwareUsed by 2 actors

DRAT

DRAT is a remote access trojan (RAT) used in campaigns attributed by Recorded Future’s Insikt Group to TAG-140, an activity cluster assessed to overlap with SideCopy, an operational subgroup or affiliate of Transparent Tribe, a suspected Pakistani state-aligned APT. In the reported campaign, TAG-140 targeted Indian government organizations and also entities associated with India’s railway, oil and gas, and external affairs ministries, with researchers noting expansion beyond government, defense, maritime, and academic sectors. The intrusion chain used a spoofed Indian Ministry of Defense press release portal and a ClickFix-style social engineering lure, with suspected spear-phishing used for delivery. Victims were induced to execute a malicious script via mshta.exe, which launched the BroaderAspect .NET loader; BroaderAspect then established persistence and installed and executed DRAT V2. DRAT V2 reflects a transition from an earlier .NET-based DRAT to a Delphi-compiled variant. The newer version uses an updated custom TCP-based, server-initiated command-and-control protocol and provides expanded capabilities including data exfiltration, payload upload, and reconnaissance. Researchers stated these functions support persistent and flexible control as well as automated and interactive post-exploitation without auxiliary tools. The malware reportedly uses basic infection and persistence methods and is detectable through static and behavioral analysis. High-confidence behavioral indicators from the reporting include execution via mshta.exe, use of the BroaderAspect loader, spoofed Ministry of Defense infrastructure, and deployment of DRAT V2 in TAG-140 operations.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Transparent Tribe

"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"

via dark readingdarkreading.com
SideCopy

"The deployment of DRAT V2 reflects TAG-140's ongoing refinement of its remote access tooling, transitioning from a .NET-based version of DRAT to a new Delphi-compiled variant"

via dark readingdarkreading.com
MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566PhishingEvidence1

"The threat group gains initial access to a victim's device through what Insikt Group considers to be a ClickFix-style social engineering lure... they suspect the attackers used spear-phishing emails."

Stealth

1 technique
T1218.005MshtaEvidence1
TacticStealth

"Victims were enticed to execute a malicious script via mshta.exe, which led to the execution of the BroaderAspect .NET loader"

Discovery

1 technique
T1082System Information DiscoveryEvidence1
TacticDiscovery

"...and conducting reconnaissance."

T1071Application Layer ProtocolEvidence1

"Version 2 of DRAT updates the custom TCP-based, server-initiated command-and-control protocol"

T1105Ingress Tool TransferEvidence1

"...uploading additional payloads..."

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

"The malware's other capabilities allow it to perform a wide variety of actions, such as exfiltrating data"

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.