Loading story…
Researchers reported that Cobian RAT, a freely advertised remote access trojan distributed on underground forums, contained a hidden backdoor planted by its original author. The malware was marketed as a basic njRAT-style tool with common surveillance and remote-control features, including keylogging, webcam access, screen capture, and arbitrary code execution on infected systems.
Analysis found that an encrypted library inside the Cobian RAT builder allowed the author to silently take over machines infected by downstream operators and even lock those operators out of their own campaigns. The covert component retrieved a command-and-control address from a preset Pastebin page, giving the author centralized control and effectively turning other criminals’ distribution activity into a crowdsourced botnet-building scheme.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Zscaler ThreatLabZ reported that it had been monitoring the Cobian RAT malware family starting in February 2017. This marks the earliest explicitly dated activity described in the references.
Researchers found that the Cobian RAT builder distributed on underground forums contained a hidden encrypted library that let the original author take control of systems infected by downstream operators. The backdoor retrieved the author's command-and-control address from a preset Pastebin page and could even lock second-level operators out of their own infections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Researchers documented continued use of **njRAT** (also known as **Bladabindi**) in targeted intrusion campaigns alongside other commodity and custom remote access trojans. Cisco Talos said the **SideCopy** APT, which targets government personnel and other entities in India, incorporated njRAT into multi-stage infection chains that often begin with malicious `.LNK` files and progress through HTAs and loader DLLs before deploying RATs and post-compromise plugins for credential theft, file enumeration, and keylogging. ESET separately reported **Operation Spalax**, a phishing-driven campaign aimed at Colombian government institutions and private-sector organizations, especially in the energy and metallurgical sectors, where attackers used shortened links, RAR archives, and multiple droppers to install njRAT, **Remcos**, and **AsyncRAT** for surveillance and remote control. A technical analysis of an **njRAT 0.6.4** sample tied to the campaign ID `splitgateukrayna` showed how the malware persists by copying itself to `%AppData%\services64.exe`, creating a Run registry key, adding a Windows Firewall exception, and using the mutex `49e91d08e684b1770e0cefa60401157a`. The sample connected to `44gang44.duckdns[.]org` on port `2222`, profiled infected systems, and supported a broad set of capabilities including hidden shell execution, keylogging, screenshot capture, registry manipulation, plugin loading, payload download-and-execute, self-update, and uninstall. Across the reported campaigns, njRAT remained a flexible, low-cost espionage tool used to establish persistence, collect victim data, and enable long-term remote access.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that **Blackremote RAT**, a newly emerged commodity remote access trojan, was advertised on underground forums by an actor using the handles **Speccy** and **Rafiki**. The malware was sold with supporting infrastructure including a builder, manager, and client component, and offered capabilities such as password recovery, keylogging, remote desktop control, scripting, and downloader functions, making it a full-featured tool for remote compromise. Researchers said Blackremote moved quickly from sale to active use, with nearly **50 samples** tied to more than **2,200 attack sessions** observed against Palo Alto Networks customers within about a month of its launch. One major campaign distributed the sample `doc00190910.exe` by email and used the command-and-control domain `renaj.duckdns[.]org` at `103.200.6[.]79`, accounting for more than **1,800 sessions** across multiple industries worldwide. Unit 42 also said the operator behind Blackremote was an **18-year-old from Sweden** and that identifying information had been provided to the relevant authorities.
Aug 14, 2026