NiceRAT Malware Targets South Korean Users via Cracked Software

Menace actors have been observed deploying a malware known as NiceRAT to co-opt contaminated gadgets into a botnet.

The attacks, which goal South Korean buyers, are developed to propagate the malware underneath the guise of cracked software program, these as Microsoft Windows, or equipment that purport to give license verification for Microsoft Business.

“Thanks to the mother nature of crack packages, facts sharing among regular buyers contributes to the malware’s distribution independently from the initial distributor,” the AhnLab Security Intelligence Middle (ASEC) claimed.

“Because threat actors usually demonstrate techniques to remove anti-malware systems for the duration of the distribution phase, it is difficult to detect the distributed malware.”

Alternate distribution vectors require the use of a botnet comprising zombie computer systems that are infiltrated by a remote access trojan (RAT) identified as NanoCore RAT, mirroring prior exercise that leveraged the Nitol DDoS malware for propagating one more malware dubbed Amadey Bot.

NiceRAT is an actively designed open-supply RAT and stealer malware composed in Python that employs a Discord Webhook for command-and-regulate (C2), allowing for the danger actors to siphon sensitive data from the compromised host.

Very first launched on April 17, 2024, the recent edition of the method is 1.1.. It can be also readily available as a premium edition, according to its developer, suggesting that it really is advertised less than the malware-as-a-support (MaaS) product.

The progress arrives amid the return of a cryptocurrency mining botnet referred to as Bondnet, which has been detected working with the large-performance miner bots as C2 servers considering that 2023 by configuring a reverse proxy utilizing a modified version of a authentic tool called Rapidly Reverse Proxy (FRP).

Found this post exciting? Comply with us on Twitter  and LinkedIn to go through additional exclusive information we article.

Some components of this write-up are sourced from:
thehackernews.com