COVERT RAT

The campaign, formally called Operation Covert Access, deploys a Rust-built Remote Access Trojan known as COVERT RAT via spear-phishing emails that closely mimic genuine federal court communications.

When the recipient opens the shortcut file, named juicio-grunt-posting.pdf.lnk and dressed up with a PDF icon, it silently invokes PowerShell with the execution policy disabled and hidden mode enabled.

This immediately triggers the batch loader, health-check.bat, which reaches out to a GitHub-hosted repository and downloads the RAT payload.

When the target opens the shortcut, the malicious script runs quietly in the background while the decoy PDF opens normally in the foreground.

Its modular design supports credential harvesting, privilege escalation, encrypted file operations, and persistent re-access.

The final payload then hides itself as msedge_proxy.exe within Microsoft Edge’s user data folder — a calculated move to blend in with trusted system processes.

What makes it particularly concerning is its built-in cleanup capability — when operators are finished, a single command erases every trace of the malware, making post-incident forensics significantly harder.

The malware then runs environment checks — querying the system manufacturer through WMIC, scanning the tasklist for tools like Wireshark, OllyDbg, and x64dbg, and examining registry paths linked to VMware, VirtualBox, and Hyper-V.

It also inspects the Process Environment Block (PEB) for active debuggers and measures timing behavior using QueryPerformanceFrequency to catch emulated environments.

Its modular design supports credential harvesting, privilege escalation, encrypted file operations, and persistent re-access.

The malware then runs environment checks — querying the system manufacturer through WMIC, scanning the tasklist for tools like Wireshark, OllyDbg, and x64dbg, and examining registry paths linked to VMware, VirtualBox, and Hyper-V.

It also inspects the Process Environment Block (PEB) for active debuggers and measures timing behavior using QueryPerformanceFrequency to catch emulated environments.

A phishing email drops a ZIP archive containing three components: a Windows shortcut (LNK) file, a batch loader script, and a convincing judicial PDF decoy.

Only when every check passes does the RAT proceed to beacon its C2 server and await operator commands.

health-check.bat, which reaches out to a GitHub-hosted repository and downloads the RAT payload.

COVERT RAT connects back to a command-and-control server at 181.231.253.69:4444, from which attackers can issue encoded instructions covering everything from file theft to ransomware deployment.