NiceRAT Malware Targets South Korean Users via Cracked Software

Danger actors have been noticed deploying a malware termed NiceRAT to co-opt infected gadgets into a botnet.

The assaults, which focus on South Korean people, are made to propagate the malware beneath the guise of cracked application, these kinds of as Microsoft Windows, or tools that purport to offer you license verification for Microsoft Business.

“Because of to the nature of crack applications, information and facts sharing amongst regular customers contributes to the malware’s distribution independently from the preliminary distributor,” the AhnLab Security Intelligence Centre (ASEC) mentioned.

“Because menace actors commonly reveal strategies to remove anti-malware plans all through the distribution phase, it is complicated to detect the distributed malware.”

Alternate distribution vectors entail the use of a botnet comprising zombie pcs that are infiltrated by a distant entry trojan (RAT) acknowledged as NanoCore RAT, mirroring prior exercise that leveraged the Nitol DDoS malware for propagating a further malware dubbed Amadey Bot.

NiceRAT is an actively made open up-source RAT and stealer malware composed in Python that uses a Discord Webhook for command-and-regulate (C2), permitting the threat actors to siphon delicate information from the compromised host.

To start with released on April 17, 2024, the existing version of the software is 1.1.. It can be also accessible as a quality model, according to its developer, suggesting that it is marketed underneath the malware-as-a-service (MaaS) model.

The development arrives amid the return of a cryptocurrency mining botnet referred to as Bondnet, which has been detected employing the significant-overall performance miner bots as C2 servers considering the fact that 2023 by configuring a reverse proxy working with a modified variation of a genuine resource known as Quick Reverse Proxy (FRP).

Located this article fascinating? Abide by us on Twitter  and LinkedIn to read through far more distinctive articles we submit.

Some parts of this article are sourced from:
thehackernews.com