Syrian Hackers Distributing Stealthy C#-Based Silver RAT to Cybercriminals

Danger actors running less than the identify Nameless Arabic have launched a distant access trojan (RAT) identified as Silver RAT that’s outfitted to bypass security software package and stealthily start concealed purposes.

“The developers work on a number of hacker community forums and social media platforms, showcasing an lively and complex existence,” cybersecurity organization Cyfirma stated in a report revealed final 7 days.

The actors, assessed to be of Syrian origin and connected to the enhancement of one more RAT identified as S500 RAT, also operate a Telegram channel supplying several companies such as the distribution of cracked RATs, leaked databases, carding activities, and the sale of Fb and X (formerly Twitter) bots.

The social media bots are then used by other cyber criminals to advertise a variety of illicit services by routinely engaging with and commenting on user information.

In-the-wild detections of Silver RAT v1. had been first observed in November 2023, though the menace actor’s plans to launch the trojan ended up 1st built official a year before. It was cracked and leaked on Telegram about Oct 2023.

The C#-based mostly malware boasts of a extensive assortment of capabilities to connect to a command-and-handle (C2) server, log keystrokes, damage procedure restore factors, and even encrypt information working with ransomware. There are also indications that an Android model is in the is effective.

“Even though making a payload employing Silver RAT’s builder, threat actors can pick several selections with a payload sizing up to a highest of 50kb,” the company mentioned. “After connected, the victim appears on the attacker-managed Silver RAT panel, which shows the logs from the sufferer based mostly on the functionalities chosen.”

An intriguing evasion aspect built into Silver RAT is its skill to delay the execution of the payload by a certain time as effectively as covertly start applications and choose manage of the compromised host.

Even further evaluation of the malware author’s online footprint demonstrates that one particular of the members of the team is very likely in their mid-20s and primarily based in Damascus.

“The developer […] seems supportive of Palestine based mostly on their Telegram posts, and members involved with this team are active throughout various arenas, like social media, enhancement platforms, underground discussion boards, and Clearnet sites, suggesting their involvement in distributing a variety of malware,” Cyfirma stated.

Uncovered this short article attention-grabbing? Observe us on Twitter  and LinkedIn to read through extra exclusive written content we article.

Some parts of this write-up are sourced from:
thehackernews.com