Magicrat

MagicRAT is a type of malware, first observed by Cisco Talos in 2022, that was used by the Lazarus Group to exploit vulnerabilities in publicly exposed VMWare Horizon platforms, primarily targeting energy companies worldwide. This malicious software, which can infiltrate systems through suspicious downloads, emails, or websites, can steal personal information, disrupt operations, and even hold data hostage for ransom. The Lazarus group, known for its use of custom malware, has been linked to both MagicRAT and its derivative, QuiteRAT. In May 2023, the Lazarus Group began deploying QuiteRAT, a smaller, more compact Qt-based implant that's clearly an evolution of MagicRAT. North Korean coders managed to reduce the size of this Trojan to 5 megabytes from MagicRAT's original 18MB by incorporating only a handful of required Qt libraries instead of the entire framework. Both Trojans are based on the Qt open-source development framework, which makes machine learning and heuristic analysis detection tools less reliable since Qt is rarely used in malware development. The campaign introduced several new malware families such as YamaBot and MagicRat, along with updated versions of NukeSped and DTrack. Significant similarities were also found between EarlyRAT and Lazarus' MagicRAT tool, indicating a potential shift in tactics and possible involvement of inexperienced operators. The use of non-traditional frameworks like Qt in malware authoring, as seen in MagicRAT and QuiteRAT, represents a definitive shift in techniques, tactics, and procedures (TTPs) from APT groups under the Lazarus umbrella.