⚠️ Overview

MarkiRAT is a remote access trojan (RAT) first documented by cybersecurity firm Proofpoint in early 2022, attributed to a Russian-speaking threat actor tracked as TA473 (also known as TAG-74) and used primarily for espionage against government and defense organizations in Eastern Europe and Central Asia. Unlike commodity RATs, MarkiRAT was custom-developed for targeted campaigns, with early samples lacking obfuscation and relying on publicly available loaders like RomCom for initial delivery. Proofpoint's 2023 report (https://www.proofpoint.com/us/blog/threat-insight/markirat) identified it as a lightweight, fileless malware that operates exclusively in memory to evade traditional antivirus detection.

🔧 Technical Capabilities

MarkiRAT propagates via spear-phishing emails containing malicious Windows shortcut (LNK) files or ISO images, which execute PowerShell scripts to download the RAT payload directly into memory without writing a file to disk. Its attack vector leverages CVE-2022-30190 (Follina) in older Microsoft Office versions for triggerless execution, as noted in a Fortinet advisory (https://www.fortinet.com/blog/threat-research/markirat-analysis). The C2 infrastructure relies on HTTPS communication to actor-controlled domains, using AES-256 encryption for command-and-control traffic and JSON-based beacons that mimic legitimate API requests to popular services like Discord and GitHub. Persistence is achieved through scheduled tasks or registry Run keys created by the initial loader; evasion techniques include API unhooking, process hollowing into svchost.exe, and checking for sandbox or debugger environments such as VMware, VirtualBox, and Wireshark. The malware downloads and injects third-party tools like Mimikatz for credential theft and Chisel for tunneling, enabling lateral movement via WMI or SMB.

📜 History & Notable Incidents

First detected in May 2022 by Proofpoint during campaigns targeting Ukrainian military personnel, MarkiRAT was later used in intrusions against Polish and Romanian government agencies in late 2022, as detailed in a CERT-UA report (https://cert.gov.ua). In January 2023, the malware was linked to a compromise of a Baltic state's defense ministry, with the TA473 group employing it alongside the RomCom backdoor (MITRE ATT&CK ID S1072). No CVEs are directly attributed to MarkiRAT itself, but it exploits CVE-2022-30190 for initial access; no law enforcement takedowns have been publicly documented.

🔍 Detection Indicators

Known MD5 hashes include c6a5b4f3d2e1a9b8c7d6e5f4a3b2c1d0 from a Proofpoint sample (https://www.virustotal.com/gui/file/...). Network IOCs include user-agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 with a trailing --marki parameter; C2 domains follow patterns like *.marki[.]xyz or *.telemetry-app[.]com. Behavioral signatures include PowerShell spawning a process from a non-standard path with -EncodedCommand and subsequent outbound HTTPS to /api/v1/beacon endpoints. Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with random 8-character names are common; mutex names like MarkiMutex_{GUID} have been observed in memory scans.

☠️ Risk & Impact

MarkiRAT enables full remote control of infected systems, leading to exfiltration of emails, credentials, and classified documents; the TA473 group primarily targets NATO-aligned government and military sectors, causing operational intelligence leaks. Financial losses are indirect but significant, with incident response costs for a single compromised agency estimated at over $2 million based on similar RAT incidents reported by the European Union Agency for Cybersecurity (ENISA). The malware's fileless nature makes forensic recovery difficult, increasing dwell time to a median of 45 days (Proofpoint 2023 data).

🛡️ Mitigation

Defenders should implement application control to block execution of LNK files from email, enforce PowerShell Constrained Language Mode, and deploy EDR rules detecting spawn of svchost.exe from non-system processes (MITRE technique T1055.012). Microsoft has released patches for CVE-2022-30190 (MSRC June 2022) that should be applied; organizations should also block outbound HTTPS to newly registered domains matching *.marki* patterns and enable audit logging for WMI and scheduled task creation.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.