Fatalrat

FatalRAT, also known as Sainbox, is a variant of the Gh0st RAT malware that targets Windows platforms. Initially identified by Proofpoint in 2020, it has become popular with the PurpleFox threat actor group. Once infiltrated into a system, FatalRAT can log keystrokes and download and install additional payloads. As per Nuspire's Q1 2023 cyber threat report, out of their top five botnets, Torpig Mebroot remains dominant, but two new botnets have emerged: NetSupport RAT and FatalRAT. In a notable campaign since April 2023, at least 20 instances have been reported where Sainbox was delivered through malicious means. In one instance, KryptoCibule, a cryptocurrency-focused malware that targeted Czech and Slovak users, spread through a popular local file sharing service, masquerading as pirated games or downloadable content (DLC). Another significant case involved Chinese-language speakers in Southeast and East Asia who were targeted with poisoned Google search results for popular applications such as Firefox, WhatsApp, and Telegram, leading to the installation of trojanized versions containing FatalRAT. The malware was also spread through fake browser and messenger apps advertised on Google Ads. The campaign involved malicious advertisements that mimicked websites of popular applications like Firefox, WhatsApp, Signal, Skype, and Telegram. While providing the legitimate software, these sites also delivered a remote access trojan called FatalRAT. This malware continues to pose a significant threat due to its ability to exploit and damage computer systems without the user's knowledge.