RATicate Expanded Malware Delivery With CloudEyE Crypter and RAT-as-a-Service Infrastructure

RATicate operated a long-running malware distribution service that delivered remote access trojans and information stealers through large-scale malspam campaigns, using shared command-and-control infrastructure and repeatable infection chains to support multiple customers. Researchers said the operation had been active since at least 2019 and functioned like a malware-as-a-service provider, distributing payloads including AgentTesla, Formbook, LokiBot, NetWire, and BetaBot against overlapping target sets.

In early 2020, the group upgraded its delivery chain by replacing custom NSIS installers with the commercial CloudEyE loader, a Visual Basic 6-based crypter that fetched encrypted second-stage payloads and complicated analysis and detection. Some campaigns used COVID-19-themed lures, and investigators linked the CloudEyE activity back to RATicate through infrastructure overlap and consistent tradecraft. After CloudEyE suspended service over abuse concerns on June 10, RATicate reverted to its earlier NSIS-based campaigns, while the crypter later resumed operations with added controls.