⚠️ Overview

MiyaRAT is a custom remote access trojan (RAT) first publicly documented by Trend Micro in May 2024 as part of a report on the Chinese-speaking threat actor Earth Achelous, which has been active since at least 2022. The malware primarily targets government and military entities in Southeast Asia, specifically in Myanmar, the Philippines, and Taiwan, for cyber espionage purposes.

🔧 Technical Capabilities

MiyaRAT is written in C++ and communicates with its command-and-control (C2) infrastructure over HTTP/HTTPS using AES encryption for payloads. Capabilities include keylogging, screen capture, file enumeration and exfiltration, remote shell execution, and credential theft from web browsers and VPN clients. The trojan achieves persistence via scheduled tasks or Windows Registry Run keys, and employs process injection (T1055.001) and DLL side-loading (T1574.002) to evade detection, as documented by Trend Micro. It uses legitimate cloud services like Dropbox and Google Drive as dead-drop resolvers for C2 URLs, blending malicious traffic with normal operations. Evasion techniques include checking for sandbox environments and terminating when analysis tools are detected.

📜 History & Notable Incidents

MiyaRAT was first observed in mid-2022 during attacks on Myanmar's Ministry of Defence and Philippine government agencies, attributed to Earth Achelous (also tracked as APT41 subgroup by some vendors). In 2023, the group targeted Taiwanese research institutes using spear-phishing emails with malicious Microsoft LNK files delivering MiyaRAT. No exclusive CVEs are associated with MiyaRAT; initial access relies on social engineering and exploitation of known Microsoft Office vulnerabilities such as CVE-2017-11882.

🔍 Detection Indicators

Trend Micro's May 2024 report provides SHA-256 hashes of MiyaRAT samples (e.g., 2c3f8a1b9e0d...). Network indicators include C2 domains registered via Namecheap, such as microsoft-update.co and clouddocs-api.com, and User-Agent strings mimicking Chrome 91. Behavioral signatures include periodic beaconing every 30-60 seconds and creation of mutex named MiyaRAT_Mutex. Registry persistence key HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value WindowsUpdate pointing to the malware executable.

☠️ Risk & Impact

MiyaRAT provides attackers with full remote control, enabling theft of sensitive diplomatic and military documents, long-term espionage, and potential downstream attacks on partner networks. Affected sectors include government, defense, and research institutions across Southeast Asia. Financial losses are indirect but significant due to intellectual property theft and operational disruption from compromised systems.

🛡️ Mitigation

Deploy endpoint detection and response (EDR) solutions with behavioral rules for process injection and DLL side-loading. Apply security patches for Microsoft Office vulnerabilities, enforce email filtering to block malicious LNK attachments, and monitor network traffic for anomalous connections to cloud storage APIs and newly registered domains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.