Loading malware…
curlRAT is a Linux remote-access trojan used as part of an espionage-oriented server intrusion toolkit targeting South Korean automotive and media organizations. It uses libcurl-based HTTP or HTTPS communications to poll operator-controlled infrastructure for tasks, normally at 12-hour intervals, with an operator-controlled fast-poll interval of 30 seconds. curlRAT can execute commands, collect system information, update its configuration, install additional payloads, and provide reverse or interactive PTY shell access, including elevated shells. It includes virtual-environment checks and HAProxy service-watchdog functionality that reports load-balancer lifecycle events. curlRAT has been deployed alongside trojanized Linux service binaries, a credential-capturing SSH component, and the Ted HAProxy backdoor.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
В атаках использовался curlRAT — отдельный RAT, который по умолчанию опрашивает управляющий сервер каждые 12 часов и по команде может сократить этот интервал до 30 секунд.
В атаках использовался curlRAT — отдельный RAT, который по умолчанию опрашивает управляющий сервер каждые 12 часов и по команде может сократить этот интервал до 30 секунд.
В атаках использовался curlRAT — отдельный RAT, который по умолчанию опрашивает управляющий сервер каждые 12 часов и по команде может сократить этот интервал до 30 секунд.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service.
The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service.
“[CurlRAT] can decrypt and execute commands stored in its configuration.”
Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform's static-content naming style.
Trojanized binaries use crond, polkitd, agetty, and atd names, while CentOS functions are named atd_ routines.
The CurlRAT watchdog reads HAProxy PID information and polls /proc to identify started, stopped, restarted, and reloaded states.
“The stager checks the operating system” and CurlRAT can “send system details.”
Специальный HTTP-запрос переводит Ted в режим C&C... Ответ возвращается через обычное соединение под видом стандартного HTTP/1.0 200 OK. CurlRAT по умолчанию опрашивает управляющий сервер каждые 12 часов.
CurlRAT uses img.monderhouse.space and img.darklights.store as fallback or backup configuration hosts.
“The stager checks for the presence of either crond or HAProxy, and only then deploys CurlRAT, retrieving it either from its data section or the edge web server.”
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Удаленный троян доступа для Linux, выполняющий команды, изменяющий собственную конфигурацию и предоставляющий интерактивную PTY-оболочку. Обычно опрашивает C2 каждые 12 часов, но может переключаться на интервал в 30 секунд.
A component of the Linux espionage toolkit that periodically contacts attacker-controlled infrastructure for remote access/control. It includes virtual-machine/environment checks and refuses to execute when expected VM indicators are absent, likely to evade sandboxed analysis.
A curl-based remote-access trojan delivered by the stager. It periodically polls C2, decrypts and executes commands from its configuration, writes new configuration payloads to disk, and can deploy an interactive PTY shell.
Remote-access trojan used in a DPRK-linked espionage campaign; it is delivered through social engineering and malicious files and enables command execution, system reconnaissance, and data theft.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.