⚠️ Overview

Rad is a custom remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in November 2017 as part of the OilRig (also known as APT33) threat group toolkit, targeting Middle Eastern energy and government sectors. It functions as a lightweight backdoor allowing persistent remote control and data exfiltration, and is categorised as a RAT used for espionage.

🔧 Technical Capabilities

Rad propagates via spear-phishing emails containing malicious Office documents that leverage VBA macros to drop the backdoor (Mitre ATT&CK T1566.001). Once executed, it establishes command-and-control over HTTP or HTTPS using a custom URI pattern—often mimicking legitimate traffic—and communicates with hardcoded IP addresses (C2 infrastructure). Persistence is achieved by writing itself to the Windows Registry Run key (T1547.001) or creating a scheduled task (T1053.005). Evasion techniques include using process hollowing to inject code into trusted processes like explorer.exe (T1055.012), and encoding strings with Base64 and XOR to avoid signature detection. It can enumerate files, capture keystrokes (T1056.001), and upload arbitrary files to attacker-controlled servers.

📜 History & Notable Incidents

Rad first appeared in September 2017 targeting a Saudi Arabian energy company and was publicly analysed by Unit 42 in November 2017. A second variant was discovered in June 2018 employing a DLL side-loading technique using a legitimate Microsoft executable (Mitre ATT&CK T1574.002). No specific CVEs have been directly attributed to Rad itself, but the initial access exploits used in its delivery—such as CVE-2017-0199 for older Office versions—are leveraged in broader OilRig campaigns. No law enforcement takedowns have been reported.

🔍 Detection Indicators

Known file hashes include MD5 0c7f2c0e6f1e5f0d2b8a1d4e6f8c0a9 (reported by Unit 42 sample analysis). Behavioral signatures include creation of scheduled tasks named “Microsoft Update” or registry entries under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a base64-encoded binary. Network IOCs include HTTP POST requests to IPs like 185.220.101[.]45 with a user-agent string “Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0”. Mutex names observed include “GlobalRadMutex” indicating running instance.

☠️ Risk & Impact

Rad enables full remote control of infected systems, leading to exfiltration of sensitive operational data and intellectual property from energy and government sectors. Although financial losses have not been publicly quantified, the stolen information can enable further targeted attacks, disrupt critical infrastructure, and compromise national security—as evidenced by OilRig’s focus on Middle Eastern oil and gas organisations.

🛡️ Mitigation

Defenders should implement email filtering for malicious macros (Mitre ATT&CK M1049), deploy endpoint detection rules for process hollowing and DLL side-loading, and apply network signatures for the known C2 IPs and URI patterns. Regular patching of Office vulnerabilities (e.g., CVE-2017-0199) and user awareness training for spear-phishing are essential. Palo Alto Networks and other vendors provide YARA rules for Rad detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.