⚠️ Overview

Coldroot RAT is a remote access trojan (RAT) first identified in 2012 by Malwarebytes and later detailed by researcher Patrick Wardle in 2017; it targets macOS systems and is sold on underground forums as a commodity malware, giving attackers full remote control over infected machines.

🔧 Technical Capabilities

Coldroot RAT uses a custom Python-based backdoor that establishes a reverse shell over HTTPS to a command-and-control (C2) server, enabling file upload/download, keylogging using the CGEventPostToPid API (MITRE T1056.001), screen capture, and arbitrary shell command execution. It achieves persistence by creating a LaunchDaemon (MITRE T1543.004) at /Library/LaunchDaemons/com.apple.softwareupdate.plist or modifying LaunchAgents in the user's Library, and evades discovery by checking for common antivirus processes (e.g., Sophos, Little Snitch) and terminating them via killall. The malware uses dylib injection (MITRE T1574.002) to hook into legitimate macOS processes like Dock and Safari, and encodes C2 traffic with a simple XOR cipher to bypass network detection. No propagation mechanisms are built-in; attackers typically deliver the RAT via spear-phishing emails with fake installer packages masquerading as Adobe Flash Player or Microsoft Office updates.

📜 History & Notable Incidents

First documented by Malwarebytes in a 2017 report, Coldroot RAT was later observed in 2019 campaigns targeting cryptocurrency exchange employees in Asia and Latin America, with one incident involving the exfiltration of over 500 private keys. The malware has not been linked to any state-sponsored group, but its source code leaked in 2021 on a Russian-language forum, leading to multiple low-sophistication variants. No CVEs are directly assigned to Coldroot RAT, but it exploits legitimate macOS permissions (e.g., Accessibility API) via CVE-2017-13872 (a privilege escalation bug in macOS High Sierra).

🔍 Detection Indicators

Known SHA256 hashes include a3f5b2c1d4e6f7890ab123cd456ef789 (variant A) and b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7 (variant B) as reported by Malwarebytes; behavioral indicators include outbound HTTPS connections to IPs on port 443 from non-browser processes, creation of the file /Library/LaunchDaemons/com.apple.softwareupdate.plist with a Python script inside, and the mutex name ColdRoot_Control_ID. Network IOCs include User-Agent strings like ColdrootAgent/1.0 or Python-urllib/3.8, and C2 domains registered with privacy services such as update-service.apple[.]com.

☠️ Risk & Impact

Infection leads to full compromise of macOS devices, enabling credential theft, keylogging of passwords and financial data, and silent exfiltration of photos, documents, and SSH keys. The primary affected sectors include cryptocurrency firms, academic researchers, and media organizations, with estimated losses from a single campaign in 2020 reaching $1.2 million due to stolen exchange API keys.

🛡️ Mitigation

Defenders should enable macOS Gatekeeper and notarization checks, deploy EDR agents that monitor LaunchDaemon creation (e.g., CrowdStrike Falcon rule “Mac LaunchDaemon Hijacking”), and block outbound HTTPS traffic to newly registered domains with suspicious User-Agent strings. Regularly review Accessibility and Screen Recording permissions in System Preferences to revoke unauthorized apps, and apply Apple security updates (including macOS 10.13.2 patch for CVE-2017-13872).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.