Stefan Mileschin

Remote access trojan pretends to be ransomware

The Microsoft security team has published details about a malware campaign that is currently spreading a remote access trojan named STRRAT that steals data from infected systems while masquerading as a ransomware attack.

The Microsoft Security Intelligence team said the STTRAT campaign is using a mass-spam distribution vector to bombard users with emails containing malicious PDF file attachments.

“Attackers used compromised email accounts to launch the email campaign”, Microsoft said in a series of tweets last night.

“The emails contained an image that posed as a PDF attachment but, when opened, connected to a malicious domain to download the STRRAT malware.”

First spotted in June 2020, STRRAT is a remote access trojan (RAT) coded in Java that can act as a backdoor on infected hosts.

According to a technical analysis by German security firm G DATA, the RAT has a broad spectrum of features that vary from the ability to steal credentials to the ability to tamper with local files.

https://fudzilla.com/news/52904-vole...are-of-the-rat