⚠️ Overview

Peppy RAT is a remote access trojan (RAT) first identified in 2013 by Trend Micro, attributed to the threat group Bitter (also tracked as T-APT-17 by Proofpoint and G1009 by MITRE ATT&CK). It is a custom-built, modular backdoor used primarily for cyber espionage against government, military, and energy sectors in South Asia, particularly targeting India, Pakistan, and Bangladesh. The tool is written in C++ and is part of a broader malware arsenal operated by the Bitter group.

🔧 Technical Capabilities

Peppy RAT propagates via spear-phishing emails with malicious Microsoft Office documents containing macros (e.g., exploiting CVE-2017-11882 for Equation Editor) to drop the payload. Its command-and-control (C2) infrastructure uses HTTP or HTTPS with encrypted communications using a custom XOR or RC4 algorithm, often hosted on dynamic DNS domains like *.ddns.net. Persistence is achieved through registry Run keys or scheduled tasks under the current user context. Evasion techniques include anti-debugging checks (e.g., IsDebuggerPresent), virtual machine detection by verifying hardware identifiers, and process hollowing to blend into legitimate processes. The RAT collects system information, keystrokes, screenshots, and enumerates drives for file exfiltration, and can execute arbitrary commands from the C2 server. It also uses a custom mutex string "Peppy_" to prevent multiple instances.

📜 History & Notable Incidents

First spotted in 2013, Peppy RAT was used in a 2016 campaign targeting Indian defence personnel via decoy documents about nuclear proliferation. In 2020, Bitter deployed Peppy RAT against Bangladeshi government organizations during a series of intrusions. No known law enforcement actions have been taken against the group, but multiple vendor reports from Trend Micro (2018), Zscaler ThreatLabZ (2021), and CYFIRMA (2022) detail its use.

🔍 Detection Indicators

Known file hashes include MD5: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d and SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example from Trend Micro reports). Network indicators include outbound connections to domains like maillog.ddns.net and User-Agent strings such as "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" used in C2 traffic. Behavioral signatures include process creation from Office applications spawning cmd.exe or powershell.exe, and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun.

☠️ Risk & Impact

The primary damage is data exfiltration of classified documents, intellectual property, and strategic intelligence, leading to long-term espionage losses. Affected sectors include defense, energy, and telecommunications in India, Bangladesh, and China, with estimated hundreds of compromised endpoints per campaign. Financial losses are difficult to quantify but entail significant remediation costs and reputational harm for targeted organizations.

🛡️ Mitigation

Organizations should implement email security filters blocking macro-enabled attachments from untrusted sources, apply patches for CVE-2017-11882 and other Office vulnerabilities, deploy endpoint detection and response (EDR) solutions with behavioral rules for RAT activity (e.g., anomalous outbound HTTP connections), and monitor for the specific mutex and registry keys listed in detection indicators. Regular user awareness training on spear-phishing is also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.