NiceRAT Malware Targets South Korean Users via Cracked Software

Risk actors have been observed deploying a malware termed NiceRAT to co-decide infected gadgets into a botnet.

The attacks, which concentrate on South Korean consumers, are developed to propagate the malware below the guise of cracked software program, this kind of as Microsoft Windows, or equipment that purport to provide license verification for Microsoft Office.

“Thanks to the mother nature of crack systems, information and facts sharing among ordinary consumers contributes to the malware’s distribution independently from the original distributor,” the AhnLab Security Intelligence Centre (ASEC) said.

“For the reason that danger actors normally demonstrate methods to clear away anti-malware plans all through the distribution phase, it is hard to detect the dispersed malware.”

Alternate distribution vectors entail the use of a botnet comprising zombie computers that are infiltrated by a remote entry trojan (RAT) recognised as NanoCore RAT, mirroring prior activity that leveraged the Nitol DDoS malware for propagating one more malware dubbed Amadey Bot.

NiceRAT is an actively designed open-source RAT and stealer malware created in Python that uses a Discord Webhook for command-and-control (C2), making it possible for the threat actors to siphon delicate info from the compromised host.

First introduced on April 17, 2024, the latest variation of the software is 1.1.. It is really also obtainable as a top quality model, according to its developer, suggesting that it really is advertised underneath the malware-as-a-company (MaaS) design.

The advancement comes amid the return of a cryptocurrency mining botnet referred to as Bondnet, which has been detected making use of the large-functionality miner bots as C2 servers given that 2023 by configuring a reverse proxy utilizing a modified model of a legitimate software referred to as Rapid Reverse Proxy (FRP).

Identified this report interesting? Abide by us on Twitter  and LinkedIn to examine far more distinctive written content we write-up.

Some parts of this article are sourced from:
thehackernews.com