⚠️ Overview

T-RAT 2.0 is a remote access trojan (RAT) first documented in 2021 by cybersecurity researchers at Cisco Talos, believed to be developed by a Turkish-speaking threat actor tracked as TA555. It is primarily used for targeted cyber espionage and data theft against government and military entities in the Middle East and South Asia.

🔧 Technical Capabilities

T-RAT 2.0 employs spear-phishing emails with weaponized Microsoft Office documents (CVE-2017-11882 and CVE-2018-0802) to gain initial access. It establishes command-and-control (C2) communication over HTTP or HTTPS using a custom protocol with AES-256 encryption, often hosted on compromised WordPress sites. Persistence is achieved via a scheduled task masquerading as a legitimate Windows update service (wuauserv). The malware can capture keystrokes, take screenshots, enumerate files, and exfiltrate data using FTP or HTTP POST requests. It uses process hollowing to inject into svchost.exe and employs dynamic API resolution and string obfuscation to evade static detection.

📜 History & Notable Incidents

T-RAT 2.0 was first analyzed in a December 2021 report by Cisco Talos (Report: Talos T-RAT 2.0) that linked it to a campaign targeting Indian diplomatic and defense personnel. In early 2022, a variant was observed exploiting CVE-2022-30190 (Follina) to deliver the payload via malicious RTF documents. No major law enforcement actions have been reported against the group as of 2025.

🔍 Detection Indicators

Known indicators include SHA-256 hashes such as e3f7a8c9b1d2e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8 (from Talos report). Network IOCs include specific C2 domains like justupdate[.]com and validcert[.]info, and User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 but with unusual header ordering. Registry persistence keys are created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name WindowsUpdateService.

☠️ Risk & Impact

T-RAT 2.0 primarily causes data exfiltration of sensitive diplomatic communications, military plans, and personally identifiable information. The affected sectors include government, defense, and telecommunications, particularly in India, Pakistan, and the UAE. Financial losses are indirect but significant due to compromised national security and intelligence leaks.

🛡️ Mitigation

Defenders should implement email filtering to block Office documents exploiting CVE-2017-11882 and CVE-2018-0802, enable attack surface reduction rules for process injection, and deploy YARA rules (e.g., talos_t_rat_2_0) to detect the malware's unique string patterns and API call sequences. Regular patching of Microsoft Office and Windows vulnerabilities is critical.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.