Loading story…
Researchers have identified QuimaRAT, a Java-based remote access trojan sold through a malware-as-a-service (MaaS) model and built to infect Windows, Linux, and macOS systems. The malware is part of a broader Quima toolkit that includes Quima Builder, Quima Loader, and Quima Dropper, enabling operators to generate payloads in formats such as JAR, EXE, APP, SH, BAT, and VBS, stage delivery through browser-cache techniques, and deploy HTML or SVG droppers. Reported pricing ranges from $150 per month to $1,200 for lifetime access, indicating an effort to lower the barrier for affiliates and other threat actors.
QuimaRAT uses a modular architecture with encrypted plugins and flexible command-and-control over TCP, WebSocket, TLS, and HTTPS, with dynamic C2 rotation reportedly supported through Pastebin-based updates. Analysis found persistence mechanisms tailored to each operating system, along with sandbox evasion, single-instance enforcement, optional decoy execution via a Binder function, and Windows fileless shellcode execution. Once deployed, the RAT can remotely execute commands, steal credentials, transfer files, manipulate the clipboard, conduct webcam surveillance, and expand functionality on demand through additional plugins.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
QuimaRAT was identified as a new Java-based remote access trojan offered as malware-as-a-service and designed to target Windows, Linux, and macOS. Reporting described it as a modular platform with builder, loader, and dropper components, encrypted plugins, and capabilities including remote command execution, credential theft, file transfer, clipboard manipulation, and webcam surveillance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro disclosed a previously undocumented Linux implant, **Quasar Linux RAT** (`QLNX`), that targets developer workstations and DevOps environments to steal credentials tied to software supply chains. The malware harvests secrets from assets including **npm**, **PyPI**, **Git**, **AWS**, **Kubernetes**, **Docker**, **Vault**, **Terraform**, **GitHub CLI**, `.env` files, SSH keys, browser data, and even `/etc/shadow`, creating a path to malicious package publication, cloud account compromise, and CI/CD abuse. Researchers said the implant combines backdoor, surveillance, credential theft, and lateral movement features, with a 58-command RAT core supporting shell execution, file management, screenshots, keylogging, clipboard theft, SOCKS proxying, TCP tunneling, and SSH-based movement across environments. The malware was built for stealth and long-term persistence on Linux systems. Trend Micro said `QLNX` runs filelessly from memory, deletes its original binary, wipes logs, spoofs process names as kernel threads, and uses multiple persistence methods including **`LD_PRELOAD`**, **systemd**, **crontab**, **init.d**, **XDG autostart**, and `.bashrc` injection. It also dynamically compiles rootkit and PAM credential-interception components on the victim host using `gcc`, then hides processes, files, and ports through a two-tier design that combines a userland `LD_PRELOAD` rootkit with an **eBPF** kernel component. Command-and-control traffic can flow over raw TCP, custom TLS, HTTP, or HTTPS, and at publication only a small number of security products reportedly detected the malware, while no actor attribution or confirmed intrusions had been publicly disclosed.
Jun 29, 2026
Group-IB reported that **SilabRAT** is being sold as a malware-as-a-service remote access trojan on Russian-language darkweb forums, with subscriptions advertised at **$5,000 per month** and linked to the Russian-speaking developer **`o1oo1`**. The malware has been observed in spam and **ClickFix** campaigns, where security tools often identify the packer as **HijackLoader** instead of the underlying payload, helping the RAT evade straightforward detection. Unlike centralized crimeware operations, SilabRAT uses operator-hosted infrastructure, allowing each buyer to run their own command-and-control server and keep victim data under their control. SilabRAT is built for stealthy remote access, account takeover, and cryptocurrency theft. Group-IB said its features include **HiddenVNC**, browser profile cloning, cookie theft, a Chrome **App-Bound Encryption** bypass via **`GoogleChromeElevationService`** COM elevation, **AMSI** bypass, **UAC** bypass through **`ICMLuaUtil`**, persistence with Registry Run keys and Scheduled Tasks, keylogging, clipboard monitoring, remote desktop, payload delivery, and process execution. The malware also targets crypto users by stealing wallet artifacts, attempting wallet password cracking with harvested browser credentials, and supporting crypto-clipping, while planned updates reportedly include customizable Electron injection against applications such as **Ledger Wallet** and **Trezor Suite**.
Jun 29, 2026
Researchers reported two **Telegram-marketed malware-as-a-service (MaaS)** offerings focused on mobile device compromise and surveillance. *ZeroDayRAT* is advertised as a subscription spyware platform claiming full monitoring of **Android and iOS** devices, with infections driven by **smishing** and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as *GitHub Pages* to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance. Separately, Cyble detailed ongoing development of *SURXRAT* (marketed as **SURXRAT V5**) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses **Android Accessibility** permissions for persistent control and uses **Firebase-backed C2**; code similarities indicate lineage from **ArsinkRAT**. Recent samples were observed conditionally downloading a **large LLM module from Hugging Face**, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.
Jun 29, 2026