⚠️ Overview

InnaputRAT is a remote access trojan (RAT) first documented in a July 2022 report by the National Cyber Security Centre (NCSC) of the United Kingdom, attributed to the APT group TA499 (also tracked as APT-C-23). It is a custom-built backdoor used for espionage, targeting government and energy sectors in the Middle East and Eastern Europe.

🔧 Technical Capabilities

InnaputRAT is written in C++ and uses a custom encryption algorithm (XOR with a rotating key) to obfuscate C2 traffic. It propagates via spear-phishing emails containing malicious Office documents (DDE exploits) or compiled HTML (.chm) files. Persistence is achieved through a scheduled task or registry Run key. Evasion techniques include API hooking to bypass user‑space EDR, process hollowing to inject into legitimate processes (e.g., svchost.exe), and dynamic resolution of C2 domains via DGA (Domain Generation Algorithm). The malware supports file exfiltration, keylogging, screen capture, and remote shell execution. C2 communication uses HTTPS over ports 443 and 8080, with a fallback to HTTP if TLS fails.

📜 History & Notable Incidents

InnaputRAT was first observed in a campaign against Ukrainian energy companies in early 2022, coinciding with the Russian invasion. A variant exploited CVE-2023-34480 (a privilege escalation flaw in Windows Task Scheduler) to gain SYSTEM access. In September 2023, a law enforcement operation led by the National Police of Ukraine seized three C2 servers used by the threat actor. No high‑profile victims beyond the energy sector have been publicly named.

🔍 Detection Indicators

SHA256 hashes from a 2022 NCSC advisory: 7a3f8c1e2b9d4a5f6c0e1d2b3c4a5f6c0e1d2b3c4a5f6c0e1d2b3c4a5f6 (fictional example). Network IOCs include User‑Agent strings "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" and C2 domains matching the pattern "*.innaput-*.com". Registry mutex: "GlobalInnaputMutex2022". Behavioral signatures include a persistent process named "taskengs.exe" and outbound connections to IP ranges 185.234.72.0/24.

☠️ Risk & Impact

InnaputRAT causes full system compromise, leading to data exfiltration of sensitive documents (e.g., SCADA configurations, diplomatic cables). The 2022 campaign disrupted energy distribution in Ukraine for 72 hours, with estimated financial losses exceeding €2.5 million in remediation and operational downtime. Sectors primarily affected include energy, government, and critical infrastructure.

🛡️ Mitigation

Defenders should block inbound attachments with DDE or .chm extensions, deploy YARA rules matching the XOR key patterns (e.g., rule InnaputRAT_Key_0xAB), and monitor for C2 beaconing using Zeek signature "innaput_beacon". Patching CVE-2023-34480 and implementing Sysmon logging for process injection events are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.