RevengeRAT Remote Access Trojan

RevengeRAT (also known as Revetrat) is an open source remote access trojan that was first observed in 2016.

Threat ID:: CC-3032
Category:: Trojan
Threat Severity:: Medium
Threat Vector:: Email spam
Published:: 24 April 2019 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

RevengeRAT (also known as Revetrat) is an open source remote access trojan that was first observed in 2016.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Introduction

This type of malware is delivered via spam or phishing emails containing Microsoft Word documents. These documents contain malicious macros which will launch an Object Linking and Embedding (OLE) file. This OLE file will then extract and install an Excel document containing a command to download a malicious JavaScript script. Once the script is executed it:

Attempts to disable Windows Defender and Office ProtectedView.
Closes all Microsoft Office applications.
Enables macros for Microsoft Word, PowerPoint and Excel.
Creates an autorun registry key to obtain and run a script which will then download RevengeRAT.

Once executed, RevengeRAT will connect to a command & control server and await further commands. RevengeRAT has the following capabilities:

Open a remote shell on the user’s system to allow execution of malicious commands.
Manage Windows system files such as the hosts file that can be modified to enable communication with malicious domains.
Create, amend or end processes and services critical to the operating system.
Create, modify or delete registry keys to enable persistence to the user’s machine.
Track the user via IP location.

Threat updates

Date	Update
20 May 2021	Revenge RAT now targeting aerospace and travel industries Spear phishing campaigns have been launched against the aerospace and travel sectors, using the RAT for data theft and dropping additional payloads such as Agent Tesla for credential stealing an data exfiltration. The loader used in the current campaign is called Snip3.

Remediation advice

To prevent and detect an infection, NHS Digital advises that:

Secure configurations are applied to all devices.
Security updates are applied at the earliest opportunity.
Tamper protection settings in security products are enabled where available.
Obsolete platforms are segregated from the rest of the network.
IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
Administrative accounts are only used for necessary purposes.
Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Last edited: 20 May 2021 1:33 pm