Loading story…
NonEuclid RAT, also tracked as NONEUCLID, SheetRAT, LiberiumRAT, and ShadowRoot, has been reported infecting devices worldwide while offering attackers full remote control of compromised Windows systems. Researchers describe the malware as a C#/.NET Framework 4.8 trojan with layered evasion and persistence features, including a rootkit, UAC bypass, obfuscation, anti-debugging, virtualization checks, dynamic Windows API invocation, and mechanisms to bypass Windows Defender and AMSI. It reportedly maintains access through scheduled tasks and registry changes, drops payloads into user AppData directories, and can reconnect to command-and-control infrastructure over TCP, with some activity also tied to Discord webhook-based C2.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A later technical analysis described NonEuclid RAT as a C#/.NET remote access trojan with defense-evasion, persistence, privilege-escalation, anti-analysis, and TCP-based command-and-control features. The report also documented ransomware behavior, including AES file encryption, the .NonEuclid extension, persistence via scheduled tasks and registry changes, AMSI bypass, and sample indicators.
A report highlighted NONEUCLID, also referred to as SheetRAT, LiberiumRAT, or ShadowRoot, as a remote access trojan that had infected devices worldwide. The report described impacts on both individuals and organizations and noted capabilities including rootkit functionality, persistence, UAC bypass, obfuscation, anti-debugging, botnet features, and Discord webhook-based command-and-control.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
Researchers across multiple reports documented continued **njRAT** (also known as **Bladabindi**) activity delivered through diverse infection chains, including malicious PowerPoint macros, phishing attachments, password-protected archives, trojanized software on Korean webhard sites, compiled AutoHotKey loaders, and typosquatted npm packages. The malware was shown using layered obfuscation in VBS and PowerShell, Base64-encoded payloads, reflective or in-memory loading, and staged retrieval from services such as `paste.ee`, `archive.org`, `wtools.io`, and dynamic DNS infrastructure. In one supply-chain case, the npm packages `jdb.js` and `db-json.js` installed a .NET payload that copied itself as `dchps.exe` and connected to `46.185.116.2:5552`, while other campaigns used domains including `fidapeste2.duckdns.org`, `xxxcarldon.duckdns.org`, and `0.tcp.eu.ngrck.io` for command and control. Analysis of multiple samples showed njRAT maintaining persistence through **Startup folder** copies, **registry Run keys**, shortcuts, mutexes, firewall-rule changes, and even `netsh` exclusions, while some variants bundled legitimate applications so victims would not notice the infection. Once active, the RAT collected host profiling data and supported a broad set of attacker functions, including **keylogging, credential theft, webcam access, screenshot and screen viewing, file transfer, process and registry manipulation, remote shell access, and full remote control** of Windows systems. Reports also linked njRAT delivery to long-running loader ecosystems that rotated payload families such as Houdini, LimeRAT, RevengeRAT, AsyncRAT, and VjW0rm, underscoring the malware’s persistence as a flexible commodity RAT used across phishing, malware-hosting, and software supply-chain abuse.
Aug 15, 2026