Loading story…
Security researchers reported that Brute Ratel C4 (BRC4/BRc4), a commercial adversary-simulation and command-and-control framework built to evade EDR and antivirus tools, has been adopted by malicious actors and observed in real intrusions. Palo Alto Networks Unit 42 analyzed a sample delivered in an ISO using an APT29-like chain—LNK file, legitimate OneDriveUpdater.exe, and DLL search-order hijacking—to load a malicious Version.dll, decrypt shellcode, and inject the payload into RuntimeBroker.exe. The implant communicated over TCP 443 with AWS-hosted infrastructure using a self-signed certificate impersonating Microsoft, and Unit 42 linked related artifacts to 41 malicious IPs, multiple BRc4 samples, and victims in North and South America. Separate reporting tied Brute Ratel activity to Black Basta operations using QBot for delivery, while an Airbus Protect incident-response case documented a newer packed Win.dll variant using anti-debugging, API hashing, dynamic syscalls, and RC4-encrypted outbound traffic to a configured C2 endpoint.
Get the actors, campaigns, and ATT&CK mapping behind it.
13 events from the most recent confirmed update back to the earliest known activity.
Airbus Protect published incident-response analysis of a recent Themida-packed Brute Ratel C4 DLL named Win.dll, including extracted configuration and YARA rules for multiple stages. The sample was found during an incident response engagement on a targeted machine.
A detection-focused article described Brute Ratel tradecraft and recommended multilayered hunting using EDR, network, and file system telemetry. It also shared a YARA rule from Yoroi Malware ZLab and a compiled set of file hashes, IPs, and a domain associated with Brute Ratel activity.
Walmart Global Tech published an updated method for decoding Brute Ratel configurations after the malware developer changed from a hardcoded RC4 key to a dynamic keying scheme. The write-up also tied one analyzed sample to reporting on Black Basta using QBot to deliver Brute Ratel and Cobalt Strike.
Splunk Threat Research published analysis of a Brute Ratel sample delivered via fotos.iso, documented the loader and agent capabilities, and released a Brute Ratel analytic story with 17 detections. The team also described using an internal Atomic-C2 proof of concept to simulate behaviors in a lab.
Team Cymru published a case study on the Mythic C2 framework, including clustering of exposed servers and links to red-team-style and Pakistan-focused infrastructure. The report also discussed a Mythic server branded as "Botleggers Club."
MDSec published Part 3 of its "How I Met Your Beacon" series focused on Brute Ratel. The reference provides only the publication anchor for this research release.
VirusTotal first recorded submission of a malicious ISO named fotos.iso from Poland. Splunk later identified it through a YARA hunt as a Brute Ratel-related sample using DLL side-loading.
Palo Alto Networks Unit 42 reported that malicious actors were abusing Brute Ratel C4 and detailed the Roshan_CV.iso infection chain, related infrastructure, nine samples, and additional impacted organizations across North and South America.
In June 2022, a researcher publicly shared a Mythic C2 server with a modified login panel displaying a "Botleggers Club" image. Team Cymru linked the branding to reporting around Conti leaks and BazarLoader/BazarBackdoor administration.
A second related sample, badger_x64.exe, was uploaded to VirusTotal by a web user in Ukraine and was configured to communicate with 159.65.186[.]50:443. Unit 42 linked it to similar Brute Ratel infrastructure and administration activity.
Unit 42 observed connection attempts from three Sri Lankan IP addresses to the Brute Ratel C2 at 174.129.157[.]251. The activity occurred between May 19 and May 20, 2022.
A malicious ISO named Roshan_CV.iso was uploaded to VirusTotal from Sri Lanka. Unit 42 later analyzed it as a Brute Ratel C4 delivery chain using an APT29-like ISO, LNK, and DLL hijacking package.
Cortex Xpanse history showed the Brute Ratel C2 listener at 174.129.157[.]251:443 was open on AWS with a self-signed certificate impersonating Microsoft. The exposure lasted from April 29, 2022 until May 23, 2022.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 177 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
11 references tracked. Mallory keeps watching after this page renders.
protect.airbus.com
Open sourceandreafortuna.org
Open sourcemedium.com
Open sourcesplunk.com
Open sourceunit42.paloaltonetworks.com
Open sourcecobaltstrike.com
Open sourceoutflank.nl
Open sourcebruteratel.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **BitRAT** distribution campaigns that used highly tailored social-engineering lures to infect Windows users with the commodity remote access trojan. In one campaign, attackers abused a Colombian cooperative bank’s compromised infrastructure and reused stolen customer records in malicious Excel files, indicating a real breach involving roughly **418,777** rows of sensitive data. Qualys said the operators likely exploited **SQL injection** with `sqlmap`, then used obfuscated macros, `certutil`, and `rundll32` to stage and launch BitRAT from payloads hosted on a throwaway GitHub repository. Separate reporting showed BitRAT also spread through fake **Windows 10 activators** shared on South Korean webhards, Discord, and social media, where a bogus activation tool downloaded the malware and attempted to weaken Windows Defender protections. Fortinet documented another BitRAT campaign that targeted **NFT enthusiasts**, using Hebrew-language Excel lures and Discord-hosted payloads to deliver the malware through batch scripts, PowerShell, and DLL injection into a copied `MSBuild.exe` process. Across the campaigns, BitRAT was described as a low-cost malware-as-a-service tool sold on underground forums since 2021, with capabilities including credential theft, keylogging, webcam and microphone access, hidden remote desktop (**HVNC**), file exfiltration, cryptocurrency mining, DDoS activity, and persistence via startup-folder placement or process injection. The reporting highlights how BitRAT operators increasingly combine stolen data, topical themes, and pirated software bait with legitimate services such as GitHub and Discord to improve infection success.
Aug 15, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026