MalwareExploits 1 CVE

MaQ RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-8088WinRAR for Windows Path Traversal via NTFS Alternate Data StreamsExploited in the wild

The RAR archive exploits CVE-2025-8088 -- a path traversal vulnerability in WinRAR's handling of NTFS Alternate Data Streams. The archive contains 30 ADS entries that, when extracted, place Updater.exe directly into the victim's Windows Startup folder.

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.006PythonEvidence1

The downloaded payload -- WindowsServices.exe -- is a 76 MB PyInstaller-packaged Python 3.13 application.

T1203Exploitation for Client ExecutionEvidence1

The RAR archive exploits CVE-2025-8088 -- a path traversal vulnerability in WinRAR's handling of NTFS Alternate Data Streams.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The archive contains 30 ADS entries that, when extracted, place Updater.exe directly into the victim's Windows Startup folder.

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

The archive contains 30 ADS entries that, when extracted, place Updater.exe directly into the victim's Windows Startup folder.

T1548.002Bypass User Account ControlEvidence1

UAC bypass -- escalates to admin without prompting

Stealth

1 technique

T1006Direct Volume AccessEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Capabilities MaQ RAT is full-featured: Keylogger -- captures all keystrokes

T1555Credentials from Password StoresEvidence1

Browser credential theft -- extracts saved passwords and cookies

Collection

4 techniques

T1056.001KeyloggingEvidence1

Capabilities MaQ RAT is full-featured: Keylogger -- captures all keystrokes

T1113Screen CaptureEvidence1

Screen recording -- records the desktop

T1123Audio CaptureEvidence1

Voice recording -- activates the microphone

T1125Video CaptureEvidence1

Webcam capture -- takes photos from the victim's camera

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

MaQ RAT communicates exclusively through Telegram Bot API via the bot @Roberta3358_bot , with FTP as a secondary exfiltration channel.

T1071.001Web ProtocolsEvidence1

The entire command-and-control infrastructure runs through Telegram's servers -- legitimate traffic that blends with the billions of Telegram API calls made daily.

T1105Ingress Tool TransferEvidence1

Updater.exe is a 6.6 KB .NET binary with a single purpose: download the real payload from a Google Cloud instance at 34[.]69[.]246[.]76 and execute it.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

FTP credentials (server, username, password for file exfiltration)

T1048Exfiltration Over Alternative ProtocolEvidence1

MaQ RAT communicates exclusively through Telegram Bot API via the bot @Roberta3358_bot , with FTP as a secondary exfiltration channel.

Other

1 technique

T1562Impair DefensesEvidence1

Windows Defender disable -- kills real-time protection

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Apr 5, 2026

A Turkish Price Quote, a WinRAR Zero-Day, and a Telegram Bot Named Roberta: How We Decrypted a RATs Entire Configuration - Breakglass Intelligence - Breakglass Intelligence

A custom Telegram-controlled remote access trojan delivered via a WinRAR exploit chain. It supports keylogging, webcam capture, screen recording, voice recording, file exfiltration via FTP, browser credential theft, UAC bypass, disabling Windows Defender, and a multi-victim leader election mechanism.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

MaQ RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2025-8088WinRAR for Windows Path Traversal via NTFS Alternate Data StreamsExploited in the wild

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.006PythonEvidence1

The downloaded payload -- WindowsServices.exe -- is a 76 MB PyInstaller-packaged Python 3.13 application.

T1203Exploitation for Client ExecutionEvidence1

The RAR archive exploits CVE-2025-8088 -- a path traversal vulnerability in WinRAR's handling of NTFS Alternate Data Streams.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The archive contains 30 ADS entries that, when extracted, place Updater.exe directly into the victim's Windows Startup folder.

Privilege Escalation

2 techniques

T1547.001Registry Run Keys / Startup FolderEvidence1

The archive contains 30 ADS entries that, when extracted, place Updater.exe directly into the victim's Windows Startup folder.

T1548.002Bypass User Account ControlEvidence1

UAC bypass -- escalates to admin without prompting

Stealth

1 technique

T1006Direct Volume AccessEvidence1

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

Capabilities MaQ RAT is full-featured: Keylogger -- captures all keystrokes

T1555Credentials from Password StoresEvidence1

Browser credential theft -- extracts saved passwords and cookies

Collection

4 techniques

T1056.001KeyloggingEvidence1

Capabilities MaQ RAT is full-featured: Keylogger -- captures all keystrokes

T1113Screen CaptureEvidence1

Screen recording -- records the desktop

T1123Audio CaptureEvidence1

Voice recording -- activates the microphone

T1125Video CaptureEvidence1

Webcam capture -- takes photos from the victim's camera

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

MaQ RAT communicates exclusively through Telegram Bot API via the bot @Roberta3358_bot , with FTP as a secondary exfiltration channel.

T1071.001Web ProtocolsEvidence1

The entire command-and-control infrastructure runs through Telegram's servers -- legitimate traffic that blends with the billions of Telegram API calls made daily.

T1105Ingress Tool TransferEvidence1

Updater.exe is a 6.6 KB .NET binary with a single purpose: download the real payload from a Google Cloud instance at 34[.]69[.]246[.]76 and execute it.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

FTP credentials (server, username, password for file exfiltration)

T1048Exfiltration Over Alternative ProtocolEvidence1

MaQ RAT communicates exclusively through Telegram Bot API via the bot @Roberta3358_bot , with FTP as a secondary exfiltration channel.

Other

1 technique

T1562Impair DefensesEvidence1

Windows Defender disable -- kills real-time protection

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Apr 5, 2026

A Turkish Price Quote, a WinRAR Zero-Day, and a Telegram Bot Named Roberta: How We Decrypted a RATs Entire Configuration - Breakglass Intelligence - Breakglass Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.