Collectionrat

CollectionRAT is a malicious software (malware) first identified in a Cisco Talos report in 2023, with samples dating as far back as 2021. This Windows-based Remote Access Trojan (RAT) is believed to be connected to the Jupiter/EarlyRAT malware family, which has previously been linked to a Lazarus subgroup, Andariel. The North Korean state-sponsored threat actor Lazarus Group has been using CollectionRAT to target healthcare entities in Europe and the United States, exploiting a now-patched vulnerability (CVE-2022-47966) affecting Zoho ManageEngine ServiceDesk to deploy QuiteRAT and CollectionRAT malware. Upon execution on a vulnerable host, CollectionRAT collects system information to fingerprint the victim's environment and sends it to the Command and Control (C2) server. It operates like most RATs by allowing the attacker to run arbitrary commands and manage files on the infected system. Additionally, it gathers metadata and can deliver additional payloads. These capabilities make CollectionRAT a potent tool for cyber espionage and disruption of operations, posing a significant threat to targeted organizations. In response to the growing threat posed by CollectionRAT and other malware types such as RustBucket, KANDYKORN, SmoothOperator, ObjCShellz, Fullhouse, POOLRAT, PondRAT, OdicLoader, and Comebacker, prevention and detection alerts have been implemented. Authorities continue to monitor the activities of the Lazarus Group and other associated Advanced Persistent Threat (APT) actors closely while encouraging organizations to maintain robust cybersecurity measures to protect against these threats.