RATs Which Won’t Flee a Ship After Sinking It

White rats are easy to tame. The same can not be said about black rats, especially if we talk about RATs belonging to black hat hackers.

In this blog post, we’re concentrating on Remote Access Trojans, malicious software that effectively grants attackers a backdoor and asserts administrative control on the targeted computers.

RATs don’t just come around your machine out of nowhere. They require some user interaction, whether we talk about downloading malicious software packages or email attachments.

Why Should One Be Wary of RATs?

Once the target machine is infected, the attacker spreads the digital disease to other vulnerable computers. Repetitive infection and spread creates a botnet ‒ a horde of zombie-computers under hacker’s control.

Fear of RATs, as well as musophobia, is perfectly understandable.

Since these trojans gain admin control on the infected computers, the intruders can do anything malicious one can imagine. To be more specific, the attackers can monitor user activity, record keystrokes, access confidential information, turn on the webcam to record video, capture screenshots, format drives, and finally delete or modify system files.

To the surprise of nobody, RATs are sneaky. They are hard to detect, as they usually do not show up on the list of running programs. More than that, intruders can manage the level of resource use to avoid alerting the user about the infection. Plus some of the RATs can be managed through Telegram, which underlines how easy hackers can control them.

RATs are primarily designed to maintain long-term control and gain intelligence on the target.

Who Should Be Prepared for Remote Access Trojans?

Remote access trojan attacks mostly concern financial and bank employees.

The attackers often host their payloads using Google Cloud Storage as a way to bypass security controls built into security products.

Basically, RATs are put in the cloud to appear like harmless sheep.

Sometimes cyber criminals choose to use malicious links instead of attachments, as malware uses both the email and the web to infect victims. In the campaign mentioned above, malicious .zip and .gz files were used instead, for example. RATs can be different both in their functionality and deployment tactic.

“Many email security products can detect malicious attachments, but identify malicious URLs only if they are already in their threat repositories.”

According to Vinay Pidathala, director of security research at Menlo Security, “a compromised machine inside an enterprise network has a wide-ranging business impact, which could be anywhere between loss of personally identifiable information to potentially much more damaging consequences like exfiltration of intellectual property.”

The financial sector companies are the favorite targets of Remote Access Trojans (RAT), but they are not the only ones who are harmed by this malware.

RATs Are the Perfect Government Spies

When Advanced Persistent Threat groups take to the “rat races,” this type of trojan turns political.

Thanks to their covertness, RATs can be used to target their own homelands or outreach and pillage the neighboring countries, whatever interests state-backed hackers the most. One example of ATP using RATs can be found in Columbia.

APT-C-36 or “Blind Eagles” used RAT to infect government agencies to steal their trade secrets. The RATs allowed hackers to control servers remotely as administered users, and target many corporations from the oil and financial industries from April 2018.

This APT posed as Chevron, Energizer, Abbott Laboratories, and auto insurance provider Progressive and the Colombian National Civil Registry to get more clicks on their phishing campaigns.

By the way, they got their name for attacking the National Institute for the Blind.

Despite hearing all about the cyber threats, most potential targets turn the blind eye on this problem, preferring to ignore it instead of taking a proactive approach.

How to Keep the RAT Malware Away?

RAT protection procedures are fairly similar to guarding your systems from other types of malware.

Some of the most critical defensive duties are the following:

1. Keeping antivirus software updated, even though new RAT malware samples may not be included in the latest databases.
   
   Advanced Malware Protection (AMP) is a more progressive option for endpoint protection than just an antivirus, as it blocks malware at the point of entry. It is noteworthy that RATs encrypt their traffic, so the company might need an additional solution to analyze obfuscated traffic.
   
   Because RATs make device fingerprints obsolete, a solution to analyze user-device interaction has more chances of identifying fraud. BioCatch uses machine learning to compare actual behavior to its historical profile, discerning anomalies in user behavior.
   
2. Blocking unused ports and known malicious domains, as well as turning off unused services are good RAT threat remediation steps.
   
   Limiting the threat attack surface comes a long way, it can save the target just by making the attacker want to find someone less equipped. 
   
   Monitoring outgoing traffic with Data Loss Prevention (DLP) systems is key to preventing the spread of malware, as well as spotting it. Detection, containment and remediation are key when dealing with RATs.
   
3. Email filtering and phishing-identifying solutions are recommended, but user education is necessary to inform employees about the risks of opening or downloading email attachments. 
   
   Email filtering and phishing-identifying solutions are recommended, but user education is necessary to inform employees about the risks of opening or downloading email attachments. 
   
   Enforcing multi-factor authentication should be a no brainer, as MFA will create an obstacle for the attacker who may have stolen login credentials. It also must be said that RATs have multiple points of entry, and email is just one of them. 
   
   Expecting safety from such trojans without having an educated, cautious, and responsible team is wrongful.
   

To expand on the third point, you may consider StealthMail as an anti-RAT measure on the email front. It allows your company to maintain a secure email communication without using email traditionally.

StealthMail retrieves email content at the moment of its creation, encrypts the content and attachments, and puts data to the protected company storage. The solution does not facilitate the transfer of confidential information over the SMTP protocol and vulnerable public email servers. Traditional email is only used to deliver Stealth Links. When you have StealthMail, attackers can no longer rely on spoofing.

StealthMail solution uses an existing email account, and it does not interfere in the current email infrastructure. StealthMail works without disrupting the traditional email protection solutions (NGFW, Sandbox, Email Appliance), complimenting them instead.You can find out more about StealthMail’s data protection strategy at StealthMail.com.