Woody RAT: A new feature-rich malware spotted in the wild

guest · Aug 3, 2022

Russian organizations attacked with new Woody RAT malware
August 3, 2022

Unknown attackers target Russian entities with newly discovered malware that allows them to control and steal information from compromised devices remotely.

According to Malwarebytes, one of the Russian organizations that were attacked using this malware is a government-controlled defense corporation.

"Based on a fake domain registered by the threat actors, we know that they tried to target a Russian aerospace and defense entity known as OAK," the Malwarebytes Labs researchers said.
Click to expand...

Dubbed Woody Rat, this remote access trojan (RAT) has a wide range of capabilities and has been used in attacks for at least one year.

This malware is currently delivered onto targets' computers via phishing emails through two distribution methods: ZIP archive files containing the malicious payload or "Information security memo" Microsoft Office documents that exploit the Follina vulnerability to drop the payloads.

"When the Follina vulnerability became known to the world, the threat actor switched to it to distribute the payload, as identified by MalwareHunterTeam."
Click to expand...

Once launched on a compromised device, the malware uses process hollowing to inject itself into a suspended Notepad process, deletes itself from the disk to evade detection from security products, and resumes the thread.

Malwarebytes is yet to attribute the malware and the attacks to a known threat group but said that a very short list of possible suspects includes Chinese and North Korean APTs.

"This very capable Rat falls into the category of unknown threat actors we track. Historically, Chinese APTs such as Tonto team as well as North Korea with Konni have targeted Russia," the researchers concluded.
"However, based on what we were able to collect, there weren't any solid indicators to attribute this campaign to a specific threat actor."
Click to expand...

Malwarebytes: Woody RAT: A new feature-rich malware spotted in the wild

The Malwarebytes Threat Intelligence team has identified a new Remote Access Trojan we are calling Woody Rat that has been in the wild for at least one year.

This advanced custom Rat is mainly the work of a threat actor that targets Russian entities by using lures in archive file format and more recently Office documents leveraging the Follina vulnerability.
Click to expand...

Log in or Sign up

Woody RAT: A new feature-rich malware spotted in the wild

guest Guest

Log in or Sign up

Woody RAT: A new feature-rich malware spotted in the wild

guest Guest

Useful Searches