Loading malware…
Atlas RAT, also known as AtlasCross RAT, is a modular Windows remote access trojan used for remote control, surveillance, and data theft. It has been deployed by the Chinese-speaking, financially motivated threat cluster TA4922 against organizations in Japan, the United Kingdom, and Germany. Atlas RAT activity overlaps with the Silver Fox ecosystem in infrastructure, tooling, and delivery methods, but these overlaps do not conclusively establish a common operator.
Delivery methods include localized human resources, payroll, and invoice-themed phishing emails linking to cloud-hosted archives, as well as trojanized software installers distributed through counterfeit software-download sites targeting Chinese-speaking users. Infection chains use DLL sideloading and staged shellcode execution. A reflective loader maps the backdoor DLL directly into memory, and additional core modules and auxiliary plugins can be retrieved from command-and-control infrastructure.
Atlas RAT supports system reconnaissance, arbitrary command execution, file management and targeted file theft, plugin and payload downloads, keylogging, clipboard collection, screenshots, audio and webcam recording, remote screen and input control, and system shutdown or reboot. Observed implementations establish scheduled-task persistence and support process injection, including injection into WeChat. An embedded PowerChell framework enables PowerShell execution within the malware process while disabling AMSI, PowerShell ETW tracing, Constrained Language Mode, and script-block logging. Other evasion measures include sandbox and virtualization checks, direct system calls, self-deletion, and termination of network connections belonging to selected Chinese security products.
Atlas RAT uses encrypted command-and-control communications. Earlier implementations used ChaCha20, while TLS-based backdoor communications appeared in July 2026. Its initial loader connection retrieves shellcode containing the full backdoor, which subsequently establishes a separate command-and-control connection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol.
Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol.
Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol.
Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
A multi-stage remote access trojan campaign is actively targeting Chinese-speaking users through a network of typosquatted domains impersonating trusted software brands.
The attacker relied primarily on human resources and business-themed lures to target victims. These campaigns delivered credential phishing, fraud, and a newly identified malware called Atlas RAT.
The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.
Infection begins when the victim downloads a ZIP archive from one of the campaign’s lure domains.
Persistence is established through the embedded PowerShell engine, which creates a scheduled task under MicrosoftWindowsAppID.
Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.
The RAT embeds the PowerChell framework, a native C/C++ PowerShell execution engine that hosts the .NET CLR directly within the malware process and disables AMSI, ETW, Constrained Language Mode, and ScriptBlock logging before executing any commands.
The shellcode resolves all its APIs dynamically through PEB walking with ROR13 hashing, completely bypassing the static import table.
Infection begins when the victim downloads a ZIP archive from one of the campaign’s lure domains.
Persistence is established through the embedded PowerShell engine, which creates a scheduled task under MicrosoftWindowsAppID.
The decoy installs a functional remote desktop client including UltraViewer_Desktop.exe , a UltraViewService Windows service for persistence
Persistence is established through the embedded PowerShell engine, which creates a scheduled task under MicrosoftWindowsAppID.
On receiving command 0x13 from the C2 server, it writes the operator-supplied payload to C:UsersPublicDocumentsWxfun.dll ... allocates RWX memory in the target via VirtualAllocEx, writes the DLL path, and triggers loading via CreateRemoteThread with LoadLibraryW as the entry point.
The decoy installs a functional remote desktop client including UltraViewer_Desktop.exe , a UltraViewService Windows service for persistence
The PE manifest requires administrator privileges, ensuring the malware runs elevated from the start.
The trojanized loader resolves its APIs dynamically through PEB walking, decrypts an embedded Gh0st RAT configuration, and downloads a second-stage shellcode payload over raw TCP, all without writing the final payload to disk.
All identified installer packages carry the same stolen Extended Validation code-signing certificate issued to a Vietnamese shell entity, lending them an appearance of legitimacy that bypasses both user suspicion and automated trust checks.
On receiving command 0x13 from the C2 server, it writes the operator-supplied payload to C:UsersPublicDocumentsWxfun.dll ... allocates RWX memory in the target via VirtualAllocEx, writes the DLL path, and triggers loading via CreateRemoteThread with LoadLibraryW as the entry point.
The self-deletion routine uses a priority manipulation technique... then resumes it to execute a ping delay followed by del against the 8.3 short path.
Victims download ZIP archives containing a triple-nested Setup Factory installer that drops a trojanized Autodesk binary alongside a legitimate decoy application.
The Setup Factory runtime itself includes several anti-analysis checks. It scans for Xen hypervisor signatures... String references to IDA suggest the runtime also checks for the presence of disassemblers at runtime.
Early in the initialization sequence the RAT also issues a WMI query ( SELECT * FROM Win32_VideoController ) to enumerate GPU hardware, likely for VM detection and host fingerprinting
A reflective PE loader within the shellcode maps the Atlas RAT DLL into memory and invokes it directly.
All three variants carry a stolen valid Extended Validation code-signing certificate issued by SSL.com to DUC FABULOUS CO.,LTD.
Before executing any scripts, the framework disables four defensive controls: AMSI bypass ... ETW bypass ... CLM bypass ... ScriptBlock logging bypass
ETW bypass ... sets it to zero, silently suppressing all PowerShell tracing events.
Even so, the surveillance features in its malware, including audio, webcam and keylogging capture, could be sold to or used by espionage actors.
@ echo off for /f "skip=1 tokens=3" %%s in ( 'query user %USERNAME%' ) do ( set SESSION_ID=%%s )
Early in the initialization sequence the RAT also issues a WMI query ( SELECT * FROM Win32_VideoController ) to enumerate GPU hardware, likely for VM detection and host fingerprinting
Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.
The Setup Factory runtime itself includes several anti-analysis checks. It scans for Xen hypervisor signatures... String references to IDA suggest the runtime also checks for the presence of disassemblers at runtime.
Early in the initialization sequence the RAT also issues a WMI query ( SELECT * FROM Win32_VideoController ) to enumerate GPU hardware, likely for VM detection and host fingerprinting
This uses the tscon.exe technique to disconnect a user’s RDP session and redirect it to the physical console, a known session hijacking method that requires SYSTEM privileges.
Even so, the surveillance features in its malware, including audio, webcam and keylogging capture, could be sold to or used by espionage actors.
Atlas RAT is a fully featured backdoor with capabilities including keylogging, screen capture, webcam recording, file management, and remote command execution.
For example, the tool can record surrounding audio, capture webcam feeds, log keystrokes, and steal clipboard data .
Even so, the surveillance features in its malware, including audio, webcam and keylogging capture, could be sold to or used by espionage actors.
Even so, the surveillance features in its malware, including audio, webcam and keylogging capture, could be sold to or used by espionage actors.
The C2 protocol uses ChaCha20 encryption... An HTTP fallback channel via WinINet with the user-agent Mozilla/4.0 (compatible) provides an alternative communication path for file downloads and C2 traffic.
With the config decrypted, the loader connects to bifa668.com on port 9899 over raw TCP... then receives exactly 386,380 bytes of second-stage shellcode into the RWX buffer.
TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.
An HTTP fallback channel via WinINet with the user-agent Mozilla/4.0 (compatible) provides an alternative communication path for file downloads and C2 traffic.
73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only in the campaign-linkage discussion. The content does not describe its functionality or establish its deployment in the analyzed attack chain.
A remote-access backdoor delivered by a loader that retrieves 300–500 kB of shellcode containing the full backdoor DLL. Around May 2026, its loader check-in changed from 'SFuck' to 'BFuck', each followed by three null bytes, with observed connections shifting from TCP ports 886 and 9899 to 443. Its legacy C2 used ChaCha20 with key and nonce fields transmitted in a cleartext header. An additional fixed-key XOR layer appeared in late March 2026 and was abandoned in June. In July 2026, the backdoor began establishing a separate TLS C2 session after the loader check-in. Reported detection indicators include JA3 e26606c572e55d499b0676e9095e3df8, JA3S f98a4985f829b6513fbeccf5b751b458, and a self-signed certificate impersonating update.microsoft.com with SHA-1 a66308a1fb09c8345228ca00335e633b2dabde53. Attribution to Silver Fox remains circumstantial; shared C2 servers with ValleyRAT suggest a shared operator.
A remote access trojan described as part of Silver Fox's broader toolset; the article notes multiple samples and versioned builds were identified, but attribution to Silver Fox is only circumstantial.
A malware family listed as part of Silver Fox's expanding arsenal.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.