Resoker and CrySome RATs Expand Windows Remote Access and Evasion Capabilities

Security researchers detailed two Windows-focused remote access trojans, ResokerRAT and CrySome RAT, that use different command-and-control approaches while emphasizing stealth and persistent access on compromised systems. ResokerRAT was reported abusing the Telegram API as its control channel, allowing operators to issue commands to infected Windows hosts through a legitimate messaging platform and blend malicious traffic with normal network activity. Analysis described capabilities associated with remote command execution, host control, and data handling, highlighting Telegram-based C2 as a low-cost and resilient mechanism for managing infections.

CrySome RAT was separately identified as an advanced .NET malware family with a broader feature set aimed at long-term compromise and operator concealment. Researchers said the malware includes AV-killer functionality to disable security tools and HVNC support, enabling attackers to interact with victim machines through hidden virtual desktop sessions without alerting users. Together, the reports show continued development of commodity and advanced RAT tooling for Windows environments, with threat actors combining trusted services, defense evasion, and covert remote-control features to improve persistence and reduce detection.