NiceRAT Malware Targets South Korean Users via Cracked Software

Menace actors have been observed deploying a malware known as NiceRAT to co-decide contaminated devices into a botnet.

The attacks, which goal South Korean buyers, are designed to propagate the malware below the guise of cracked computer software, these types of as Microsoft Windows, or equipment that purport to provide license verification for Microsoft Business.

“Owing to the nature of crack packages, information sharing among normal end users contributes to the malware’s distribution independently from the first distributor,” the AhnLab Security Intelligence Centre (ASEC) said.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

“Simply because threat actors typically explain methods to take away anti-malware packages during the distribution phase, it is complicated to detect the distributed malware.”

Alternate distribution vectors contain the use of a botnet comprising zombie personal computers that are infiltrated by a distant access trojan (RAT) acknowledged as NanoCore RAT, mirroring prior activity that leveraged the Nitol DDoS malware for propagating one more malware dubbed Amadey Bot.

NiceRAT is an actively developed open up-resource RAT and stealer malware published in Python that takes advantage of a Discord Webhook for command-and-regulate (C2), enabling the menace actors to siphon sensitive information and facts from the compromised host.

Initially produced on April 17, 2024, the recent model of the method is 1.1.. It really is also readily available as a premium variation, according to its developer, suggesting that it is really advertised below the malware-as-a-provider (MaaS) model.

The development will come amid the return of a cryptocurrency mining botnet referred to as Bondnet, which has been detected making use of the significant-effectiveness miner bots as C2 servers given that 2023 by configuring a reverse proxy working with a modified edition of a legit resource referred to as Quick Reverse Proxy (FRP).

Identified this write-up appealing? Comply with us on Twitter  and LinkedIn to examine more unique content we put up.