Loading story…
Multiple investigations detailed STRRAT, a Java-based remote access trojan, being delivered through phishing emails, malicious Office documents, JAR attachments, and even trojanized MSI installers with appended JAR content. Analysts found operators using obfuscation and packaging tricks to hide the malware, including embedding ZIP/JAR archives after valid MSI data, disguising payloads inside spam-delivered attachments, and hosting follow-on stages on services such as AWS and GitHub. In one infection chain, a malicious Excel file downloaded a large ZIP archive over HTTP and unpacked both STRRAT and a bundled Java Runtime Environment into a deceptive Windows path, while another campaign used a Java downloader to deploy both VCURMS and STRRAT.
The malware was reported to support credential theft, keylogging, file management, remote command execution, reverse proxying, and remote desktop abuse through RDP-related components, with some samples also carrying a crude .crimson file-renaming ransomware module. Researchers noted that STRRAT can run even on systems without Java by installing its own JRE, reducing a traditional barrier to infection. Observed infrastructure included DuckDNS-based command-and-control, direct IP communications, Proton Mail for VCURMS tasking, and encrypted STRRAT configurations that exposed identifiers such as Khonsari, underscoring continued evolution in both delivery methods and post-compromise capability.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
FortiGuard Labs described a phishing campaign using a malicious Java downloader from AWS-hosted infrastructure to fetch and execute both the VCURMS RAT and STRRAT, with multiple obfuscation layers and email-based command and control for VCURMS.
A malware analysis blog examined a sample masquerading as a legitimate MSI installer and found appended ZIP/JAR content containing Java classes under the carLambo package, concluding the file carried STRRAT hidden after valid MSI data.
FortiGuard Labs analyzed a phishing campaign that impersonated Maersk Shipping and delivered STRRAT directly as a Java JAR inside ZIP attachments, rather than via an intermediate dropper. The report documented persistence, credential theft, keylogging, HRDP-based remote control, pseudo-ransomware behavior using the .crimson extension, and campaign infrastructure including acalpulps.com, ftqplc.in, 198.27.77.242, and jbfrost.live.
SANS ISC published analysis of a 2021 STRRAT infection chain showing that a macro-enabled Excel lure downloaded a 72.1 MB ZIP archive containing both STRRAT and JRE 8 Update 261, allowing the Java RAT to run even if Java was not installed on the victim host.
A malicious Excel spreadsheet associated with a STRRAT infection chain was submitted to bazaar.abuse.ch. The sample used macros to fetch a ZIP archive, unpack a bundled JRE and STRRAT JAR, and run the malware from a deceptive C:\User directory.
G DATA analyzed a Java-based STRRAT 1.2 campaign delivered through spam email with a malicious JAR attachment, detailing its VBScript-based installer, persistence, credential theft, remote access features, and a ransomware component that only renames files with a .crimson extension.
Securityinbits documented a malware delivery technique in which Ratty and Adwind JAR payloads were appended to signed MSI files, and released the 'jar_in_msi' YARA rule to detect MSI files containing embedded JAR/ZIP structures. The post also shared related indicators of compromise and extraction examples for the polyglot-style payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
fortinet.com
Open sourceforensicitguy.github.io
Open sourcefortinet.com
Open sourceisc.sans.edu
Open sourcegdatasoftware.com
Open sourcesecurityinbits.com
Open sourcesecurityscorecard.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft Threat Intelligence reported an active malware campaign targeting gamers by distributing **trojanized gaming utilities** through browsers and chat platforms, leading victims to execute a multi-stage downloader that ultimately installs a **Java-based remote access trojan (RAT)**. The infection chain was observed staging a portable Java runtime and launching a malicious JAR (`jd-gui.jar`), while using **PowerShell** and living-off-the-land binaries such as `cmstp.exe` to reduce detection. The activity includes defense evasion by deleting the initial downloader and adding **Microsoft Defender exclusions**, and persistence via a scheduled task and a startup script named `world.vbs`; the RAT then beacons to **`79.110.49[.]15`** for C2, enabling data theft and follow-on payload delivery. Reporting also noted the campaign’s use of gaming-adjacent filenames to increase execution likelihood (e.g., `Xeno.exe`, `RobloxPlayerBeta.exe`) and emphasized that the final payload functions as a **loader/runner/downloader/RAT** rather than a single-purpose stealer, increasing the risk of secondary malware deployment. Separately, one report highlighted the emergence of *Steaelite*, a Windows RAT advertised on criminal forums with claimed “FUD” capabilities and an integrated panel combining data theft and ransomware features, underscoring broader commoditization of multi-function RAT ecosystems even when not directly tied to the specific trojanized-gaming-tools intrusion chain.
Jun 29, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026