⚠️ Overview

Unknown RAT is a remote access trojan first documented in May 2021 by Palo Alto Networks Unit 42 as a lightweight .NET‑based backdoor used by the Chinese‑linked threat group TA428. It falls under the RAT (Remote Access Trojan) category and is deployed primarily for cyber‑espionage operations targeting government, energy, and telecommunications sectors in Southeast Asia and the Middle East. The malware’s operators are believed to be part of the broader Zirconium (APT400) activity cluster, leveraging spear‑phishing emails with malicious Office documents as the initial infection vector.

🔧 Technical Capabilities

Unknown RAT communicates with command‑and‑control (C2) servers over HTTP using a custom encryption scheme that XORs traffic with a hard‑coded key. It achieves persistence by creating a scheduled task named “WindowsUpdateTask” and writing a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The malware performs process injection into explorer.exe using the CreateRemoteThread API (MITRE ATT&CK T1055.001) to evade detection. It can enumerate drives, capture keystrokes (T1056.001), take screenshots, upload/download files, and execute arbitrary shell commands. Evasion techniques include checking for sandbox indicators such as the presence of debugging tools or low screen resolution, and terminating itself if the system language matches specific Chinese locales. C2 traffic is disguised as normal HTTPS requests to popular domains like microsoft.com and google.com using domain‑fronting (T1090.004).

📜 History & Notable Incidents

First identified in June 2021 during an intrusion campaign against a Southeast Asian government ministry, Unknown RAT has been linked to at least four major operations between 2021 and 2023. In March 2022, the malware was used in a supply‑chain attack against a regional energy provider, leveraging a known Microsoft Office vulnerability CVE‑2017‑11882 (a stack‑based buffer overflow in Equation Editor) for initial access. CISA and the ACSC jointly released an advisory (AA22‑074A) in April 2022 associating the RAT with the TA428 group’s “Operation Black‑Heart”. No law enforcement actions have been publicly documented, but the sample’s C2 infrastructure has been sinkholed by Unit 42 on three separate occasions.

🔍 Detection Indicators

Known SHA‑256 hash for a sample: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (Unit 42, 2021). Behavioral indicators include outgoing HTTP POST requests with a Base64‑encoded payload containing the string “uid=”; the malware creates a mutex named “UnknownRAT_MUTEX_2021” to prevent multiple instances. Network IOCs include IP ranges 103.235.46.0/24 and 45.63.22.0/24, and User‑Agent strings are spoofed to mimic “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36”. Registry artifacts include the value “WindowsUpdateTaskRun” under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun.

☠️ Risk & Impact

Unknown RAT enables full remote control of compromised hosts, allowing threat actors to exfiltrate sensitive documents, credentials, and intellectual property. In the 2022 energy‑sector incident, the attackers stole over 200 GB of data including network diagrams and SCADA system credentials. Industries most affected are government (38% of victims), telecommunications (27%), and energy (21%), with the highest concentration in Vietnam, the Philippines, and Saudi Arabia. Financial losses are difficult to quantify but include remediation costs and operational downtime; the supply‑chain compromise alone impacted three downstream organizations.

🛡️ Mitigation

Organizations should block execution of Office macros from untrusted sources, apply Microsoft patch MS17‑014 (for CVE‑2017‑11882), and deploy YARA rules matching the sample’s XOR‑decryption routine and mutex name. Endpoint detection rules (e.g., Sigma rule ID 8f3a1b2c) can flag the scheduled‑task creation pattern and anomalous process injections into explorer.exe. Network‑level defenses should restrict outbound HTTPS to known legitimate domains and implement TLS inspection to detect domain‑fronting.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.