Crimson Rat

Crimson RAT is a malicious software, or malware, primarily used by the threat actor known as APT36 or Transparent Tribe. This custom .NET Remote Access Trojan (RAT) has been observed in multiple instances of cyber-attacks, mainly targeting India and Afghanistan. Over time, alongside Crimson RAT, Transparent Tribe has also employed other custom .NET malware and a Python-based RAT named Peppy. Notably, some variants of Crimson RAT have been identified using cracked versions of a commercial obfuscation tool, Eazfuscator, to disguise their code. The malware can infiltrate systems through suspicious downloads, emails, or websites and once inside, it is capable of exfiltrating system information, capturing screenshots, starting and stopping processes, and enumerating files and drives. In April, SentinelLabs spotted an expansion of this long-running threat actor's interest into the Indian education sector, utilizing Crimson RAT through a cluster of malicious documents. These documents stage the malware using Microsoft Office macros or OLE embedding. Moreover, the names and content of these lure documents, along with the associated domains and use of Crimson RAT, suggest that these recent activities are part of a previously reported campaign by Transparent Tribe. Upon closer inspection, SentinelOne discovered that what was initially identified as Crimson RAT was actually a server-side implant used by the attackers to manage client components. This discovery highlights the evolving nature of the threat posed by Transparent Tribe. Furthermore, SentinelOne noted that Crimson RAT variants implement different obfuscation techniques of varying intensities, such as simple function name malformation and dynamic string resolution. Several Crimson RAT .NET implementations were observed with timestamps between July and September 2022, indicating ongoing activity by the threat actor.