Romanian cybersecurity firm flushes out 'RadRAT' espionage tool


London, April 15 (IANS): Bucharest-headquartered cybersecurity company Bitdefender has flushed out "RadRAT", a powerful all-in-one toolkit for complex espionage ops that was apparently unnoticed since 2015.

This advanced remote access tool -- which offers full control over seized computers was operating since at least 2015, the company said in a statement.

Th tool has been used in targeted attacks aimed at exfiltrating information, or monitoring victims in enterprises or large businesses running Windows.

"Our interest was stirred by its remote access capabilities, which include unfettered control of the compromised computer, lateral movement across the organisation and rootkit-like detection-evasion mechanisms," the company said in its research.

In addition to its very powerful data exfiltration mechanisms, "RadRAT" features interesting lateral movement mechanisms that include credentials harvesting, using the infected machine to retrieve a Windows password, among others.

"RadRAT's" current command set supports 92 instructions.

For file or registry operations, for example, the attacker can the tool to gain specific knowledge about the file layout and registry data of the victim machine or of network connected machines.

The attacker has the ability to read any file, list the shares of machines on the network, obtain a list of files inside a directory or get their sizes.

Some advanced commands operate on chunks of larger files, being able to read them, compute and compare hashes of byte sections inside the file and upload them.

  

Top Stories


Leave a Comment

Title: Romanian cybersecurity firm flushes out 'RadRAT' espionage tool



You have 2000 characters left.

Disclaimer:

Please write your correct name and email address. Kindly do not post any personal, abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful or similar comments. Daijiworld.com will not be responsible for any defamatory message posted under this article.

Please note that sending false messages to insult, defame, intimidate, mislead or deceive people or to intentionally cause public disorder is punishable under law. It is obligatory on Daijiworld to provide the IP address and other details of senders of such comments, to the authority concerned upon request.

Hence, sending offensive comments using daijiworld will be purely at your own risk, and in no way will Daijiworld.com be held responsible.