Malware

GoodPersonRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

The malicious file poses as a setup tool for LetsVPN... Instead of just installing the VPN, it also drops a hidden remote access trojan... the installer contains a real, signed copy of LetsVPN software.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1059Command and Scripting InterpreterEvidence1

Once connected to its server, GoodPersonRAT keeps an open line of communication... It can open a live command prompt... and run commands.

T1574Hijack Execution FlowEvidence1

It specifically goes after Telegram Desktop... while patching the app so no warning message ever appears on screen.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1543.003Windows ServiceEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1055Process InjectionEvidence1

The second file acts as a loader. It reserves a block of memory and reads in a third file... then loads that program directly into memory without saving anything to disk.

T1543.003Windows ServiceEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

Stealth

4 techniques

T1055Process InjectionEvidence1

The second file acts as a loader. It reserves a block of memory and reads in a third file... then loads that program directly into memory without saving anything to disk.

T1070Indicator RemovalEvidence1

Since it never writes its final payload to disk, it becomes much harder for standard antivirus tools to catch and analyze.

T1140Deobfuscate/Decode Files or InformationEvidence1

This shellcode decrypts a much larger hidden program using a simple repeating key, then loads that program directly into memory without saving anything to disk.

T1574Hijack Execution FlowEvidence1

It specifically goes after Telegram Desktop... while patching the app so no warning message ever appears on screen.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

It can log keystrokes... capture keystrokes... File Name gongzuo.txt Keylogger and clipboard exfiltration file

T1528Steal Application Access TokenEvidence1

It specifically goes after Telegram Desktop, copying its session data and quietly rerouting traffic through a server chosen by the attacker, all while patching the app so no warning message ever appears on screen.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

It can... move files freely, run commands... transfer files in either direction

Collection

3 techniques

T1056.001KeyloggingEvidence1

It can log keystrokes... capture keystrokes... File Name gongzuo.txt Keylogger and clipboard exfiltration file

T1113Screen CaptureEvidence1

It can... watch the screen and move the mouse remotely.

T1115Clipboard DataEvidence1

It can... read clipboard contents... File Name gongzuo.txt Keylogger and clipboard exfiltration file

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

That final program is the actual GoodPersonRAT client. It reaches out to one of several backup servers built into the code... Once connected to its server, GoodPersonRAT keeps an open line of communication instead of checking in periodically.

T1090ProxyEvidence1

It can... even reroute a victim’s internet traffic through a hidden proxy... copying its session data and quietly rerouting traffic through a server chosen by the attacker.

T1105Ingress Tool TransferEvidence1

The malware can even update its own core code by downloading a fresh version from its server whenever the attacker wants new features.

T1219Remote Access ToolsEvidence1

Once active, GoodPersonRAT gives an attacker almost complete access to the infected system. It can... watch and control the screen in real time, move files freely, run commands...

Other

1 technique

T1562Impair DefensesEvidence1

To stay hidden, the program checks which security software is running on the machine and adjusts its behavior accordingly. On systems with Microsoft Defender, it goes further and adds exclusions so its own files are never scanned, while also disabling automatic sample submission entirely.

INDICATORS OF COMPROMISE

IOCs tracked for this family

40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

40 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 9, 2026

GoodPersonRAT Uses Fake LetsVPN Installer to Give Attackers Full Remote Control

A remote access trojan delivered via a fake LetsVPN installer that loads in memory and gives attackers near-complete control of the infected system. It supports command execution, file transfer, keylogging, clipboard theft, screen monitoring and control, proxying traffic, Telegram Desktop session theft and patching, Defender exclusion changes, persistence via service and scheduled task, and self-updating from C2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching40

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GoodPersonRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence1

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1059Command and Scripting InterpreterEvidence1

Once connected to its server, GoodPersonRAT keeps an open line of communication... It can open a live command prompt... and run commands.

T1574Hijack Execution FlowEvidence1

It specifically goes after Telegram Desktop... while patching the app so no warning message ever appears on screen.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1543.003Windows ServiceEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

T1055Process InjectionEvidence1

The second file acts as a loader. It reserves a block of memory and reads in a third file... then loads that program directly into memory without saving anything to disk.

T1543.003Windows ServiceEvidence1

Persistence is handled through a background service and a scheduled task set to run at system startup, ensuring the infection survives a reboot.

Stealth

4 techniques

T1055Process InjectionEvidence1

The second file acts as a loader. It reserves a block of memory and reads in a third file... then loads that program directly into memory without saving anything to disk.

T1070Indicator RemovalEvidence1

Since it never writes its final payload to disk, it becomes much harder for standard antivirus tools to catch and analyze.

T1140Deobfuscate/Decode Files or InformationEvidence1

This shellcode decrypts a much larger hidden program using a simple repeating key, then loads that program directly into memory without saving anything to disk.

T1574Hijack Execution FlowEvidence1

It specifically goes after Telegram Desktop... while patching the app so no warning message ever appears on screen.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

It can log keystrokes... capture keystrokes... File Name gongzuo.txt Keylogger and clipboard exfiltration file

T1528Steal Application Access TokenEvidence1

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

It can... move files freely, run commands... transfer files in either direction

Collection

3 techniques

T1056.001KeyloggingEvidence1

It can log keystrokes... capture keystrokes... File Name gongzuo.txt Keylogger and clipboard exfiltration file

T1113Screen CaptureEvidence1

It can... watch the screen and move the mouse remotely.

T1115Clipboard DataEvidence1

It can... read clipboard contents... File Name gongzuo.txt Keylogger and clipboard exfiltration file

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

T1090ProxyEvidence1

It can... even reroute a victim’s internet traffic through a hidden proxy... copying its session data and quietly rerouting traffic through a server chosen by the attacker.

T1105Ingress Tool TransferEvidence1

The malware can even update its own core code by downloading a fresh version from its server whenever the attacker wants new features.

T1219Remote Access ToolsEvidence1

Once active, GoodPersonRAT gives an attacker almost complete access to the infected system. It can... watch and control the screen in real time, move files freely, run commands...

Other

1 technique

T1562Impair DefensesEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

40 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Jul 9, 2026

GoodPersonRAT Uses Fake LetsVPN Installer to Give Attackers Full Remote Control

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching40

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.