Loading malware…
Cotx RAT is a custom Windows remote access trojan associated with the Chinese espionage group TA428 and prominently used in Operation LagTime IT against East Asian government organizations. It has been observed in targeted intrusions against agencies involved in information technology, domestic affairs, foreign affairs, scientific research, political processes, and economic or financial development.
The malware has been delivered through spearphishing campaigns using Royal Road-generated RTF lure documents that exploit Microsoft Equation Editor vulnerabilities, including CVE-2018-0798. In observed intrusions, exploitation led to deployment of a malicious Word add-in and subsequent DLL side-loading of the Cotx RAT payload through legitimate executables. Cotx RAT has also appeared alongside Poison Ivy as part of the same operational cluster.
Cotx RAT is an espionage-oriented backdoor written in C++ that stores encrypted configuration data within the PE image and uses encrypted communications, including AES-protected configuration or beacon data and TLS-enabled command-and-control traffic. It is proxy-aware and designed for stealthy operation in enterprise environments. Reported functionality includes host reconnaissance, process listing, shell access, software enumeration, screenshot capture, file operations, configuration updates, and self-removal. In broader TA428 intrusions, Cotx RAT has been used after initial compromise to maintain control of victim systems while operators conducted credential theft, internal reconnaissance, and lateral movement with additional tooling.
Cotx RAT is most strongly associated with TA428 activity targeting East Asia, including Mongolia and Japan-related operations, and is part of a broader toolset that has overlapped with Royal Road-enabled campaigns attributed to China-linked threat activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
攻撃者はEternal Blueを悪用して同一ネットワーク上のいくつかのホストに移動することに成功すると、そのうちの1つのホスト上で興味深いマルウェアを動かし始めました。
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA428 was also particularly active, using PoisonIvy, Cotx RAT, Tmanger, and nccTrojan to attack East Asian organizations such as Mongolia.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
We observed the following commands: 5 - Open command shell 6 - Open command shell as logged in user 7 - Send command to command shell
Spear phishing emails included malicious .doc attachments that were actually RTF files saved with .doc file extensions.
The initial beacon contains “|”-delimited system information... Computer name... Username... Windows version... Architecture... Local IP addresses... First adapter's MAC address
We observed the following commands: 2 - Get directory info or drive info
Poison Ivy C&C Communication ... Tmanger C&C Communication ... nccTrojan C&C Communication
The command and control structure of Cotx RAT is proxy aware. It utilizes wolfSSL for TLS encrypted communication.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TA428が使う他のRATとして比較目的でのみ言及。
A remote access trojan used by TA428 in targeted attacks.
攻撃者がコンピュータの制御を得るために使用したRAT。
Custom remote access trojan written in C++ and delivered via malicious RTF/Equation Editor exploitation. It is side-loaded through RasTls.dll, stores encrypted configuration in a .cotx PE section and the registry, communicates over TLS via proxy-aware C2, and supports commands including shell access, file operations, screenshots, process control, configuration updates, and self-removal.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.