Brute Ratel

Brute Ratel is a malicious software (malware) that has been increasingly used by cyber threat actors to exploit and damage computer systems. It is often delivered through suspicious downloads, emails, or websites and can infiltrate systems without the user's knowledge. Once inside, Brute Ratel can steal personal information, disrupt operations, or even hold data hostage for ransom. The malware is known to deliver multiple payloads, including the Havoc and Brute Ratel post-exploitation frameworks and a new variant of the PhantomCore remote access trojan (RAT). Additionally, it has been utilized to sign a dynamic-link library DLL that loads the offensive security tool known as Brute Ratel C4. Cyber attackers have been observed using forged lure documents to target diplomatic staff, attempting to deliver their custom loaders to drop public post-exploitation tools such as Cobalt Strike or Brute Ratel C4. In one instance, the SharpHound utility was run via Brute Ratel in an injected svchost.exe process to output JSON files that were ingested into BloodHound, describing various aspects of the Active Directory Organisational Units, Group Policies, Domains, User Groups, Computers, and Users. The ALPHV Blackcat affiliates have claimed to use Brute Ratel C4 and Cobalt Strike as beacons to command and control servers. These tools provide "beacons" to these servers, while the open-source adversary-in-the-middle (AitM) attack framework Evilginx2 enables them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. Qakbot-affiliated actors have also been noted to increasingly use Brute Ratel as a vehicle to drop other malware, most notably Cobalt Strike, Brute Ratel, and a slew of ransomware.