Malware

MostereRAT

MostereRAT is a high-severity Windows remote-access trojan distributed through business-themed phishing campaigns targeting Japanese users. Victims are induced to follow malicious links, download a file, and open an embedded archive that executes the malware. MostereRAT uses Easy Programming Language (EPL), impeding analysis, and applies defense-evasion measures including interference with security products and Windows security features. Its command-and-control communications are protected with mutual TLS. The malware deploys legitimate remote-administration tools including AnyDesk and TightVNC, creates a concealed administrative user account for persistence, enables remote control of infected systems, collects data, and can install further payloads. It reportedly evolved from a banking trojan first observed in 2020.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

The attack begins with convincing phishing emails, designed to look like legitimate business inquiries, to trick Japanese users.

T1566.002Spearphishing LinkEvidence1

When a victim clicks on a malicious link in the email, a compromised file automatically downloads.

Execution

1 technique

T1204User ExecutionEvidence1

This file then guides the victim to open an embedded archive, which contains the malicious program.

Persistence

1 technique

T1136Create AccountEvidence1

The malware also creates a hidden user account with administrative privileges, ensuring it can maintain access even if the victim thinks they have removed the threat.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

Once the malware is running, it deploys a variety of remote access tools like AnyDesk and TightVNC.

Collection

1 technique

T1560Archive Collected DataEvidence1

This file then guides the victim to open an embedded archive, which contains the malicious program.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

This allows them to control the system, collect data, and even install more malicious payloads.

T1573Encrypted ChannelEvidence1

the malware secures its communication with the Command and Control (C2) server using a highly advanced method called mutual TLS (mTLS), which makes its network traffic much harder to detect and intercept.

Other

1 technique

T1562Impair DefensesEvidence1

The malware also actively works to disable security tools and anti-virus software by blocking their network traffic and even shutting down Windows security features.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cyber security newsNews

Aug 26, 2026

New CoreRAT Malware Gives Core Werewolf Hackers Full Control of Compromised Systems

A Windows RAT mentioned only as a comparison for a document-decoy delivery technique.

cloudatg insightsNews

Feb 13, 2026

AI Development & Software Engineering | CloudATG

Phishing-delivered malware that evolved from banking malware into a RAT; uses evasion, data theft, and plugin-based extensibility (per excerpt).

risky biz rssNews

Sep 10, 2025

Risky Bulletin: US charges major ransomware figure

Remote access trojan distributed via phishing campaigns, enabling unauthorized access to infected systems.

hackreadNews

Sep 8, 2025

MostereRAT Targets Windows, Uses AnyDesk and TightVNC for Full Access

MostereRAT is a Windows-targeting remote access trojan delivered through phishing emails. It uses EPL to hinder analysis, disables or interferes with security tools, uses mutual TLS for C2 communications, deploys remote access tools such as AnyDesk and TightVNC, and creates a hidden administrative user account for persistence and continued remote control.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MostereRAT