Trusted Design

Neutralizing Remote Access Trojan Efficacy

概要

Continuously incorporating known remote access trojan (RAT) controller locations into operational defense workflow and detection technologies is useful, and automating correlation with internal telemetry will identify potential infections, but the deeper value to the business, that reduces risk, is to understand the adversary behind each RAT instance. Adversary attribution is difficult, but worthwhile, since motivation informs methodology. Exploring an attacker’s capabilities and infrastructure becomes an ancillary benefit. One of the best ways to achieve consistent attribution results is to develop original attribution methodologies. An example of one such methodology – proactive Internet services enumeration – and the applied results for Trojans like njRAT and Dark Comet are detailed in this report.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• PoisonIvy adapts to communicate through Authentication Proxies (score: 0.64)
• Blurring of Commodity and Targeted Attack Malware (score: 0.64)
• Darkhotel’s attacks in 2015 (score: 0.63)
• PROOFPOINT 2016-03-01: Operation Transparent Tribe (score: 0.62)
• Darkhotel’s attacks in 2015 (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る