NiceRAT Malware Targets South Korean Users via Cracked Software

Menace actors have been observed deploying a malware known as NiceRAT to co-decide contaminated devices into a botnet.

The attacks, which goal South Korean buyers, are designed to propagate the malware below the guise of cracked computer software, these types of as Microsoft Windows, or equipment that purport to provide license verification for Microsoft Business.

“Owing to the nature of crack packages, information sharing among normal end users contributes to the malware’s distribution independently from the first distributor,” the AhnLab Security Intelligence Centre (ASEC) said.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“Simply because threat actors typically explain methods to take away anti-malware packages during the distribution phase, it is complicated to detect the distributed malware.”

Alternate distribution vectors contain the use of a botnet comprising zombie personal computers that are infiltrated by a distant access trojan (RAT) acknowledged as NanoCore RAT, mirroring prior activity that leveraged the Nitol DDoS malware for propagating one more malware dubbed Amadey Bot.

NiceRAT is an actively developed open up-resource RAT and stealer malware published in Python that takes advantage of a Discord Webhook for command-and-regulate (C2), enabling the menace actors to siphon sensitive information and facts from the compromised host.

Initially produced on April 17, 2024, the recent model of the method is 1.1.. It really is also readily available as a premium variation, according to its developer, suggesting that it is really advertised below the malware-as-a-provider (MaaS) model.

The development will come amid the return of a cryptocurrency mining botnet referred to as Bondnet, which has been detected making use of the significant-effectiveness miner bots as C2 servers given that 2023 by configuring a reverse proxy working with a modified edition of a legit resource referred to as Quick Reverse Proxy (FRP).

Identified this write-up appealing? Comply with us on Twitter  and LinkedIn to examine more unique content we put up.