tightvnc

A new remote access trojan sold on dark web forums has been built to drain cryptocurrency, hijacking victims' logged-in sessions to slip past passwords and multi-factor checks. Dubbed SilabRAT, the malware has been detailed in new analysis from Group-IB, which found it advertised since late 2025 as a malware-as-a-service (MaaS) offering at $5000 a month. Its developer, a Russian-speaking actor known as o1oo1, also sells a code-obfuscation tool called AsmCrypt and discounts buyers who take both. Buyers run their own campaigns, often spreading SilabRAT through email spam and ClickFix lures, and antivirus tools frequently log it as the HijackLoader packer rather than the payload. One operator claimed more than 90% of infected machines stayed online across a month-long campaign. Hidden Control and Cloned Browsers Two features set SilabRAT apart. The first, a hidden virtual network computing (HVNC) solution, allows an operator to control a machine with no visible windows or cursor movement. Because the activity comes from the victim's own device and IP address, security tools often treat it as a legitimate session. The second, browser-profile cloning, goes beyond stealing cookies. Modern sites tie sessions to a device fingerprint or IP, so SilabRAT copies the entire browser profile, including extensions, storage and fingerprinting traits, to the attacker's system to revive the session intact. The two interlock: a bundled DLL, Target.dll, hooks low-level file calls so the browser opens the cloned profile, letting the hidden session run on the victim's live data while the real desktop stays untouched. Built to Empty Crypto Wallets The payoff is cryptocurrency. A background module runs continuously, hunting for wallets on new infections and trying to crack their passwords with credentials lifted from the victim's browser, working through a built-in list of supported wallets. To reach those browser secrets, SilabRAT bypasses Chrome's App-Bound Encryption with a COM-elevation technique, while a clipboard clipper can swap a copied wallet address for the attacker's mid-transaction. It pairs those with the usual commodity-RAT toolkit: Keystroke logging and clipboard capture Remote desktop access over TightVNC A user account control bypass also used by LockBit and BlackMatter Persistence via registry keys or scheduled tasks Group-IB expects the crypto focus to deepen, pointing to the developer's stated plan to inject code into Electron-based wallet apps such as Ledger Live and Trezor Suite. To blunt the threat, the company urged defenders to enforce multi-factor authentication (MFA), keep Chrome patched and step up phishing and web filtering, while cautioning that a hijacked session can still walk past a password prompt.

North Korean Lazarus hackers compromised three European companies in the defense sector through a coordinated Operation DreamJob campaign leveraging fake recruitment lures. The threat group's activity was detected in late March and targeted organizations involved in the development of unmanned aerial vehicle (UAV) technology. ‘Operation DreamJob’ is a long-running Lazarus campaign where the adversary, posing as a recruiter at a big company (either real or fake), approaches employees at an organization of interest with job offers for a high-profile role. The targets are tricked into downloading malicious files that give hackers access to the systems of the target company. The tactic has been used in the past against cryptocurrency and DeFi firms, software developers, journalists, security researchers, and also organizations in the defense sector, including the aerospace industry. Researchers at cybersecurity company ESET say that in the most recent Operation DreamJob they analyzed, Lazarus focused on UAV-related technology, which aligns with current geo-political developments and coincides with North Korea’s increased effort to build a drone arsenal "inspired" by Western designs. Targeting makers of drone components ESET observed in late March that "in-the-wild [DreamJob] attacks successively targeted" a metal engineering firm in Southeastern Europe, an aircraft parts maker, and a defense company, both in Central Europe. However, the cybersecurity company did not provide any details on the success the hackers had with targeting the three companies. All three companies make military equipment that is currently deployed in Ukraine as part of their countries' military assistance. Two of them, though, "are clearly involved in the development of UAV technology, with one manufacturing critical drone components and the other reportedly engaged in the design of UAV-related software." Analyzing the infection chain, the researchers found that it started with the victim launching a trojanized open-source application or plugin, such as the MuPDF viewer, Notepad++, WinMerge plugins, TightVNC Viewer, libpcre, and DirectX wrappers. Loading the trojanized DLL or malware dropper was achieved through DLL sideloading, an evasion technique that uses a legitimate but vulnerable software to load the malicious payload. In the next stage, the payload is decrypted and loaded directly into memory using MemoryModule-style routines. The final stage malware is the ScoringMathTea RAT (Remote Access Trojan), which establishes communication with the command-and-control (C2) infrastructure and awaits instructions. In one alternative infection chain, a malware loader named BinMergeLoader (MISTPEN) is used instead of the RAT, which abuses the Microsoft Graph API and tokens to retrieve additional payloads. The ScoringMathTea RAT, first documented in 2023, supports 40 commands in its latest version, which give the attackers a broad range of operational versatility, from command execution to dropping new malware. “The implemented functionality is the usual required by Lazarus: manipulation of files and processes, exchanging the configuration, collecting the victim’s system info, opening a TCP connection, and executing local commands or new payloads downloaded from the C&C server,” explains ESET. ESET comments that despite the repeated exposure of Operation DreamJob tactics and social engineering lures via reports, it continues to remain an effective modus operandi for North Korean threat actors. The cybersecurity company provides an extensive set of indicators of compromise (IoCs) for the domains and malicious tools Lazarus hackers used in the DreamJob campaign against European organizations in the defense sector. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A phishing campaign delivering a new strain of malware, MostereRAT, has been uncovered by cybersecurity researchers. The Remote Access Trojan (RAT) targets Microsoft Windows systems and gives attackers complete control over compromised machines. According to FortiGuard Labs, which discovered the threat, what sets this campaign apart is its layered use of advanced evasion techniques. The malware is written in Easy Programming Language (EPL), a Chinese-based coding language rarely used in cyberattacks, and relies on multiple stages to hide malicious behavior. It can disable security tools, block antivirus traffic and establish secure communications with its command-and-control (C2) server using mutual TLS (mTLS). Attack Chain and Delivery The campaign begins with phishing emails that appear to be legitimate business inquiries, mainly targeting Japanese users. Once a victim clicks a link, a Word document containing a hidden archive is downloaded. That file directs the user to open an embedded executable, which launches the malware. The executable decrypts its components and installs them in the system directory. Services are then created to ensure persistence, with some running under SYSTEM-level privileges for maximum access. Before closing, the program displays a fake message in Simplified Chinese suggesting the file is incompatible, a tactic meant to encourage further spreading. Lauren Rucker, senior cyber threat intelligence analyst at Deepwatch, said: "Given the initial attack vector is phishing emails leading to malicious links and website downloads, browser security is a critical area for defense." She added that enforcing policies that restrict automatic downloads and limit user privileges can help prevent escalation to SYSTEM or TrustedInstaller. MostereRAT uses several methods to interfere with security protections. It can disable Windows Update, terminate antivirus processes and block security tools from communicating with their servers. The malware also escalates privileges by mimicking the TrustedInstaller account, one of the most powerful on Windows systems. "While this malware uses some creative techniques to evade detection by chaining together novel scripting languages with trusted remote access tools, it is still following a common pattern of exploiting overprivileged users and endpoints without application control," explained James Maude, field CTO at BeyondTrust. Capabilities and Remote Access Tools Once established, the RAT supports a wide range of functions, including: Keylogging and system information collection Downloading and executing payloads in EXE, DLL, EPK or shellcode formats Creating hidden administrator accounts for persistence Running remote access tools like AnyDesk, TightVNC and RDP Wrapper FortiGuard Labs noted that parts of the malware's infrastructure were previously linked to a banking trojan reported in 2020. Its evolution into MostereRAT highlights how threat actors continue to refine techniques to evade modern detection systems. Maude stressed the importance of reducing privileges and controlling applications. "If you remove the local administrator privilege, you vastly reduce the attack surface and limit the impact of a malware infection," he concluded.