T-RAT Remote Access Trojan
T-RAT is a new remote access trojan that uses the Telegram secure messaging service to receive commands in order to evade traditional detection methods.
Summary
T-RAT is a new remote access trojan that uses the Telegram secure messaging service to receive commands in order to evade traditional detection methods.
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
First observed in late September 2020, T-RAT is a commercial remote access trojan that uses Telegram channels in place of a more traditional server-based command and control infrastructure.
Delivery
As T-RAT is sold directly to affiliate users, they may delivery it in whatever manner they choose. At the time of publication, it has been observed being distributed both in spam email campaigns and through malvertising sites.
Both vectors drop an initial dropper package which is unique to each affiliate user. This dropper then connects to an attacker-controlled server to download and install the T-RAT executable.
Activities
Once installed, T-RAT will connect to a hard-coded URL that links to the attacker's Telegram channel where it will await further commands. By default, T-RAT is able to:
- extract files and directories
- navigate the affected file system
- terminate process
- disable taskbar and Task Manager
- launch PowerShell terminals
- initiate VNC sessions
- copy content from the clipboard
- log keystrokes and record audio from connected microphones
- take screenshots
- bypass UAC
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 29 October 2020 3:56 pm