New JhoneRAT Malware Targets Middle East

guest · Jan 17, 2020

New JhoneRAT Malware Targets Middle East
Researchers say that JhoneRAT has various anti-detection techniques
January 17, 2020
https://threatpost.com/new-jhonerat-malware-targets-middle-east/152002/

Researchers are warning of a new remote access trojan (RAT), dubbed JhoneRAT, which is being distributed as part of an active campaign, ongoing since November 2019, that targets victims in the Middle East. Once downloaded, the RAT gathers information on the victims’ computers and is also able to download additional payloads.

Researchers note that the attackers have also made use of various cloud services, such as Google Drive and Google Forms, as part of the payload’s infection process.

“The campaign shows an actor that developed a homemade RAT that works in multiple layers hosted on cloud providers,” said researchers with Cisco Talos in a Thursday analysis.
The RAT is first spread to victims via malicious Microsoft Office documents.

“It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure,” said researchers. “Moreover, this kind of infrastructure uses HTTPS and the flow is encrypted that makes man-in-the-middle interception more complicated for the defender.”
Click to expand...

Cisco Talos: JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

Log in or Sign up

New JhoneRAT Malware Targets Middle East

guest Guest

Log in or Sign up

New JhoneRAT Malware Targets Middle East

guest Guest

Useful Searches