Loading story…
Researchers detailed Klingon RAT, a Golang-based remote access trojan active since at least 2019 and assessed to be operated by financially motivated cybercriminals. The malware uses extensive custom code and encrypted TLS communications with command-and-control infrastructure, with a primary server identified at 185.188.183[.]144:1141 alongside additional related indicators. Klingon RAT collects host and network information, maintains persistence through multiple mechanisms, and attempts to evade defenses by terminating antivirus processes.
The malware gives operators broad post-compromise control, including reverse shell access, SOCKS proxying, RDP, arbitrary binary execution, updates, and PowerShell execution. Researchers also reported several privilege-escalation options, including a UAC bypass technique associated with Event Viewer, and said the malware can deploy tools such as PAExec and an LSASS memory dumper to expand access and harvest credentials, underscoring its utility as a full-featured intrusion platform.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Intezer reported that the analyzed Klingon RAT sample had been active since at least 2019. The malware is described as a Golang-based remote access trojan used by cybercriminals for financial gain.
Intezer published a technical analysis of Klingon RAT, detailing its persistence, privilege-escalation, command-and-control behavior, and attacker capabilities. The report also identified a primary C2 server at 185.188.183[.]144:1141 and additional IOC infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Researchers at Solar 4RAYS uncovered a long-running cyber-espionage campaign targeting at least four companies that provide services to Russian government organizations, identifying a previously unseen Golang backdoor dubbed **GoblinRAT**. The intrusions reportedly ran from at least October 2020 through 2023 and relied on highly stealthy, hands-on-keyboard activity on Linux systems. Investigators said the operators abused built-in Linux utilities, used unique persistence names on each host, masqueraded malicious processes as legitimate services such as **Zabbix**, **memcached**, `vmtoolsd`, `cron`, and Red Hat subscription components, and in some cases executed malware only in memory. The malware was also hidden as a malicious library loaded into `atop`, while command-and-control infrastructure used compromised legitimate websites and DDNS services.
Aug 15, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026