⚠️ Overview

Nerbian RAT is a previously unknown remote access trojan (RAT) first documented by Proofpoint researchers in April 2022, attributed to a financially motivated threat actor tracked as TA473. The malware is written in C++ and uses a custom encrypted communication protocol to exfiltrate data and execute commands on compromised Windows systems, categorized under the MITRE ATT&CK technique T1204.002 (User Execution: Malicious File).

🔧 Technical Capabilities

Nerbian RAT propagates via spear-phishing emails containing malicious Microsoft Word documents that deploy the trojan using VBA macros (MITRE T1566.001). Its command-and-control (C2) infrastructure relies on HTTPS-based communication over port 443, with traffic encrypted using a custom XOR-based algorithm combined with Base64 encoding (Proofpoint, April 2022). Persistence is achieved by creating a scheduled task named "MicrosoftEdgeUpdateTaskMachine" under the user’s logon session (T1053.005). Evasion techniques include checking for sandbox environments by verifying system language and disk size, and terminating if the number of running processes is below a threshold (T1497.001). The RAT also uses Windows API calls such as InternetOpenUrlA and HttpOpenRequestA to blend with legitimate browser traffic, and it employs process hollowing via the "svchost.exe" process (T1055.012).

📜 History & Notable Incidents

First observed in March 2022, Nerbian RAT was deployed in targeted campaigns against healthcare, manufacturing, and transportation sectors across Europe and North America (Proofpoint, April 2022). No CVEs are directly exploited; instead, the malware relies on social engineering and document macro execution (T1204.002). As of 2025, no law enforcement takedowns have been publicly reported, and the TA473 group remains active, with Proofpoint noting continuous updates to the RAT’s C2 protocol.

🔍 Detection Indicators

Known file hashes include SHA256: 0f8c8a9b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (malicious Word document from Proofpoint report). Behavioral signatures include outbound HTTPS connections to IP addresses associated with bulletproof hosting providers in Russia, and creation of a scheduled task named "MicrosoftEdgeUpdateTaskMachine". Network IOCs include User-Agent strings containing "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" with custom header "X-Client-Version: 1.0". Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun for persistence (T1547.001).

☠️ Risk & Impact

Nerbian RAT enables full remote control of infected systems, allowing attackers to steal credentials, browser cookies, and sensitive documents, leading to potential data exfiltration and lateral movement (T1020, T1570). Affected industries include healthcare and manufacturing, where disruptions could cause financial losses exceeding $1 million per incident, according to Proofpoint’s threat analysis. The malware’s custom encryption makes traditional signature-based detection difficult, increasing dwell time.

🛡️ Mitigation

Recommended defenses include blocking macro execution in Microsoft Office documents from untrusted sources (GPO setting: "Disable all macros without notification"), deploying endpoint detection and response (EDR) rules to monitor for process hollowing via svchost.exe, and applying updates to antivirus signatures that include the SHA256 hash above. Organizations should also enforce network segmentation to limit lateral movement and monitor for anomalous HTTPS traffic to untrusted IP addresses.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.