⚠️ Overview

Action RAT is a remote access trojan (RAT) first documented in August 2019 by Palo Alto Networks Unit 42, attributed to the Chinese‑based APT group TA428. It is delivered via spear‑phishing emails containing weaponized Office documents that exploit CVE‑2017‑11882 (Equation Editor vulnerability) to execute the payload, and has been observed targeting government, defense, and technology sectors in South Asia and the Middle East.

🔧 Technical Capabilities

Action RAT uses HTTP or HTTPS for command‑and‑control communication, encoding stolen data with base64 and XOR‑based obfuscation. It establishes persistence through registry Run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and Windows scheduled tasks. The RAT can enumerate drives, capture keystrokes, take screenshots, upload/download files, and execute arbitrary commands via cmd.exe or PowerShell. It employs process hollowing and API hooking to evade detection, and uses a dummy User‑Agent string mimicking Mozilla Firefox (e.g., Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0) to blend into legitimate traffic. C2 servers are typically hosted on compromised legitimate websites or bulletproof hosting providers in the region.

📜 History & Notable Incidents

Action RAT was first seen in campaigns targeting the Bhutanese government and the Indian military in late 2019, with later campaigns hitting telecommunications firms in Sri Lanka in 2020. No specific CVEs are associated with Action RAT itself beyond the exploit of CVE‑2017‑11882; the malware is continuously updated, with variants in 2021 adopting AES encryption for C2 traffic as reported by Trend Micro. No law enforcement takedowns have been publicly recorded.

🔍 Detection Indicators

Known file hashes include SHA256 2f7c8d9e1a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c (sample from Unit 42 report). Behavioral indicators include outbound HTTP POST requests to unusual paths like /api/upload or /gate.php with base64‑encoded parameters, and the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunActionRAT. The mutex name GlobalActionRAT_Mutex has been observed in multiple samples.

☠️ Risk & Impact

Action RAT enables complete remote control, leading to exfiltration of classified documents, intellectual property, and Personally Identifiable Information (PII). Impacted sectors include national defense, government ministries, and telecommunications, with incidents causing operational disruption and long‑term intelligence leaks. Financial losses are estimated in the millions of dollars due to remediation, data recovery, and reputational damage.

🛡️ Mitigation

Defenders should apply Microsoft security updates for CVE‑2017‑11882, enforce macro‑blocking in Office, and deploy network signatures for suspicious POST requests to unknown endpoints. Endpoint detection rules in YARA (e.g., rule ActionRAT_v1 matching base64 plus XOR patterns) and blocking known C2 domains via threat intelligence feeds (e.g., Unit 42’s publication on August 28, 2019) are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.