ByteRAT: the dark sorcerer of cyberspace

Remote access trojans — Image by Cybernews.

“The Dark Sorcerer of Cyberspace” – that’s how ByteRAT is introduced by RAT developers: a sophisticated trojan that operates as a Remote Administration Tool (RAT) targeting both Windows and MacOS users.

The primary function of this RAT (remote access trojan) is to acquire user account credentials and extract data from Chromium (Chrome, Brave, Opera) and Gecko (Firefox) browsers and the potential to access over 100 different types of cryptocurrency wallets.

Our research team discovered this RAT in darknet forums.

Dangers of RATs (Remote Access Trojans)

Remote Access Trojans (RATs) pose significant dangers to computer systems, especially when targeting popular operating systems like Windows and macOS.

RATs can provide attackers with unauthorized access to a victim's computer. Once installed, they allow remote control and management of the compromised system.
Attackers can use RATs to steal sensitive information, such as personal data, login credentials, financial information, and intellectual property.
RATs often have features that enable attackers to monitor users' activities, including keystrokes, screen captures, and webcam feeds. This surveillance capability can lead to privacy violations.
Attackers can manipulate files, install additional malicious software, or change system settings using the remote control capabilities of a RAT.
Some RATs are designed to self-replicate and spread to other systems. This can lead to widespread infections within a network or even across the internet.
In some cases, RATs are used as part of a botnet to launch DDoS attacks. This can lead to service disruptions and downtime for targeted websites or networks.
Attackers may use RATs to deploy ransomware or engage in extortion by threatening to release sensitive information unless a ransom is paid.
RATs can be used to delete or corrupt files, leading to data loss and potential damage to the operating system.
Many RATs are designed to maintain persistence on a compromised system, making them challenging to detect and remove.
Some advanced RATs employ anti-forensic techniques to evade detection by security tools and forensic analysis, making it more difficult to identify and mitigate the threat.

Other known RATs

Back Orifice: This rootkit is one of the best-known examples of a RAT. A hacker group known as the Cult of the Dead Cow created Back Orifice to expose the security deficiencies of Microsoft's Windows OS.
Beast: This RAT uses a client-server architecture, and even though it was developed in 2002, it's still being used today to target both old and new Windows systems.
Sakula: Also known as Sakurel and Viper, this RAT first emerged in 2012 and was used throughout 2015 in targeted attacks. Threat actors use Sakula to run interactive commands and download and execute additional components.
Blackshades: This self-propagating RAT spreads by sending out links to the infected user's social media contacts. The infected machines are then used as botnets to launch a DDoS attack.
CrossRAT: This RAT is particularly difficult to discover and can target most OSes, including Linux, Windows, macOS, and Solaris.
Saefko: This RAT, which is written in .NET, stays in the background and views the user's browser history, looking to steal cryptocurrency-related transaction data.
Mirage: A type of malware also known as an APT, Mirage is run by a state-sponsored Chinese hacking group that carries out data exfiltration activities against military and government targets.

Key Takeaways

RATs are designed to bypass protections.
As RAT developers have said themselves – it is a new product.
The cost per build is $50.
RATs provide attackers with unauthorized access and control over a victim’s computer or network, enabling them to execute commands and manipulate the system remotely.
RATs establish communication with a remote server (C2) controlled by the attacker. The server serves as the command center for sending instructions and receiving data from the infected system.

How to protect against RATs?

It's crucial to maintain up-to-date antivirus software, regularly apply security patches, use strong and unique passwords, employ network firewalls, and practice safe browsing habits. Additionally, user education and awareness are vital components of a comprehensive cybersecurity strategy.
RATs are trojans that commonly masquerade as legitimate applications and may be composed of malicious functionality added to a real application. Monitor applications for abnormal behavior, such as notepad.exe generating network traffic.
It’s important to monitor network traffic, because an attacker can use a RAT to remotely control an infected computer via the network. A RAT deployed on a local device communicates with a remote command and control (C&C) server. Look for unusual network traffic connected to such communications, and use tools like web application firewalls (WAF) to monitor and block C&C communications.