Loading malware…
MagicRAT is a Lazarus Group remote access trojan associated with North Korean state-sponsored intrusion activity. It emerged in 2022 in campaigns targeting organizations such as energy providers and was also linked to broader Andariel/Lazarus operations against exposed enterprise infrastructure. The malware has been observed following exploitation of internet-facing systems, particularly VMware Horizon servers compromised via Log4Shell, and later reporting ties related MagicRAT-family activity to exploitation chains involving ManageEngine ServiceDesk. Security reporting and government advisories place MagicRAT within the Lazarus/Andariel malware ecosystem alongside implants such as VSingle, TigerRAT, YamaBot, QuiteRAT, and related tooling.
MagicRAT is a Windows implant written in C++ and notable for statically linking the Qt framework despite lacking a graphical interface. This design increases binary size and complicates reverse engineering and some heuristic detection approaches. The malware stores configuration data on disk using Qt facilities and disguises those artifacts to resemble legitimate operating system resources. It communicates with command-and-control infrastructure over HTTP, performs initial host reconnaissance using built-in system commands, and can exfiltrate collected data over its existing command-and-control channel.
Core functionality includes arbitrary command execution through a remote shell, basic file manipulation, configurable sleep timing, command-and-control reconfiguration, and self-removal. MagicRAT has also been observed downloading additional executable payloads, including tools disguised as benign file types, indicating a role in staging follow-on capability. Persistence has been documented through Windows Scheduled Tasks and Startup-folder mechanisms.
Operationally, MagicRAT has been used as part of hands-on-keyboard intrusions in which operators conducted reconnaissance, maintained long-term access, and supported espionage objectives. In some compromises it appeared as an interim implant later replaced by other Lazarus malware such as VSingle. Reporting also identifies QuiteRAT as belonging to the MagicRAT family or as an evolution of it, reflecting continued development of lightweight Qt-based Lazarus RATs. Victimology associated with MagicRAT and closely related activity includes energy, healthcare, internet backbone infrastructure, defense, aerospace, nuclear, engineering, and other strategically relevant sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The initial vector was the exploitation of the Log4j vulnerability on exposed VMware Horizon servers... Cisco Talos identified the exploitation of the Log4Shell vulnerability on VmWare Horizon public-facing servers as the initial attack vector.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Talos has also discovered the use of a recently disclosed implant we're calling "MagicRAT" in this campaign. ... we observed the deployment of a new implant we're calling "MagicRAT" along with VSingle.
특히 과거 공격에 사용된 Andarat, Andaratm, Phandoor, Rifdoor 외에도 수년 전부터 확인되고 있는 TigerRAT, MagicRAT 등 백도어 유형이 많다.
Over the last 15 years, the group has developed RATs, including the following... ▪ MagicRAT
22 distinct techniques documented for this family, organized by ATT&CK tactic.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Multiple entries describe creating .lnk shortcuts in Startup folders, such as BACKSPACE creating a shortcut to itself in the CSIDL_STARTUP directory and DarkGate creating an LNK object in the victim startup folder. | The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The content repeatedly notes creation of '.lnk shortcut' files in the Startup folder, such as BACKSPACE creating a shortcut in CSIDL_STARTUP, DarkGate creating an LNK object in the victim startup folder, and Operation Dream Job placing LNK files into victims' startup folder.
“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.
Multiple entries describe creating .lnk shortcuts in Startup folders, such as BACKSPACE creating a shortcut to itself in the CSIDL_STARTUP directory and DarkGate creating an LNK object in the victim startup folder. | The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.
The content repeatedly notes creation of '.lnk shortcut' files in the Startup folder, such as BACKSPACE creating a shortcut in CSIDL_STARTUP, DarkGate creating an LNK object in the victim startup folder, and Operation Dream Job placing LNK files into victims' startup folder.
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Kapeka masquerades as a Microsoft Word Add-In file, with the extension .wll, but is a malicious DLL file.
Many entries explicitly describe deleting artifacts 'to cover tracks,' 'evade detection,' 'remove evidence,' 'reduce their footprint,' or as part of 'post-intrusion cleanup process.' Examples include APT28 deleting files to cover tracks, FIN5 using SDelete to clean up the environment, and Dragonfly deleting operational files as part of cleanup.
The content repeatedly describes adversaries and malware deleting files, directories, droppers, scripts, logs, archives, staged data, and other artifacts from compromised systems, e.g., 'APT29 has used SDelete to remove artifacts from victim networks' and 'Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.'
The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
The actors disguise their malware within HTTP packets to appear as benign network traffic... [T1090, T1071].
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced for shared/overlapping implementation artifacts (a hardcoded session ID) with DLRAT; described as part of Lazarus’ shift toward non-traditional development frameworks (e.g., Qt).
Qt-based remote access trojan/implant used by Lazarus Group, observed in campaigns including those leveraging Log4j; described as similar to QuiteRAT (with QuiteRAT likely a compacted variant).
Qt-framework-based Lazarus Group RAT family described as larger/bulkier than QuiteRAT and including built-in persistence (e.g., scheduled tasks). Shares core capabilities with QuiteRAT such as arbitrary command execution, obfuscated strings (base64 plus additional measures like XOR), and C2-controlled dormancy/sleep behavior.
Mentioned only as another Andariel-associated backdoor family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.