GodRAT remote access trojan delivery via malicious .SCR files
Malware Activity
Summary
Hide ▲
Show ▼
The GodRAT remote access trojan is being delivered to financial institutions through malicious .SCR files, creating an active infection chain that can steal data and stage additional payloads. The lure uses Skype and steganography to hide shellcode inside image files before fetching the malware from a C2 server. Activity has been observed since September 9, 2024 and as recently as August 12, 2025, with targets across Hong Kong, the UAE, Lebanon, Malaysia, and Jordan.
Related Happenings
Silver Fox South Asia phishing campaign
Campaign
H score39
First: 24.03.2026 18:00
Last: 24.03.2026 18:00
Sources 1
About this happening:
The **Silver Fox** campaign now includes **BYOVD** abuse of a previously unknown **WatchDog Anti-malware** driver, **amsdk.sys (version 1.0.600)**, to disable security tools on co...
Silver Fox South Asia phishing campaign
CampaignAbout this happening: The **Silver Fox** campaign now includes **BYOVD** abuse of a previously unknown **WatchDog Anti-malware** driver, **amsdk.sys (version 1.0.600)**, to disable security tools on co...
Tomiris multi-language malware modules using Discord and Telegram C2
Malware Activity
H score16
First: 01.12.2025 07:07
Last: 01.12.2025 07:07
Sources 1
About this happening:
The **Tomiris** malware set is now using **Discord** and **Telegram** as C2, making its post-exploitation traffic harder to spot and letting operators blend in with legitimate ser...
Tomiris multi-language malware modules using Discord and Telegram C2
Malware ActivityAbout this happening: The **Tomiris** malware set is now using **Discord** and **Telegram** as C2, making its post-exploitation traffic harder to spot and letting operators blend in with legitimate ser...
BADAUDIO first-stage downloader activity
Malware Activity
H score36
First: 21.11.2025 12:42
Last: 21.11.2025 12:42
Sources 1
About this happening:
The **BADAUDIO** malware is now documented as a **first-stage downloader** that can **decrypt and execute AES-encrypted payloads** from a hard-coded **C2 server**, increasing the...
BADAUDIO first-stage downloader activity
Malware ActivityAbout this happening: The **BADAUDIO** malware is now documented as a **first-stage downloader** that can **decrypt and execute AES-encrypted payloads** from a hard-coded **C2 server**, increasing the...
Kimsuky HttpTroy backdoor activity against South Korean users
Malware Activity
H score16
First: 05.11.2025 04:00
Last: 05.11.2025 04:00
Sources 1
About this happening:
**Kimsuky** has been tied to fresh **March and April 2026** campaigns against **South Korean military and corporate entities**, using **fake security-software pages** and a **coun...
Kimsuky HttpTroy backdoor activity against South Korean users
Malware ActivityAbout this happening: **Kimsuky** has been tied to fresh **March and April 2026** campaigns against **South Korean military and corporate entities**, using **fake security-software pages** and a **coun...
Airstalk malware abusing AirWatch MDM APIs for covert C2
Malware Activity
H score22
First: 31.10.2025 18:08
Last: 31.10.2025 18:08
Sources 1
About this happening:
The **Airstalk** malware activity linked to **CL-STA-1009** is abusing **AirWatch/Workspace ONE MDM APIs** for covert **command-and-control** and data theft, increasing stealth ri...
Airstalk malware abusing AirWatch MDM APIs for covert C2
Malware ActivityAbout this happening: The **Airstalk** malware activity linked to **CL-STA-1009** is abusing **AirWatch/Workspace ONE MDM APIs** for covert **command-and-control** and data theft, increasing stealth ri...
Timeline
-
19.08.2025 17:33 1 articles · 9mo ago
GodRAT artifacts detected across multiple regions
Campaign Scope UpdateScreen saver artifacts carrying GodRAT are detected targeting Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan, showing the campaign's geographic spread across multiple countries and territories.
Show sources
- New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code — thehackernews.com — 19.08.2025 17:33
-
19.08.2025 17:33 1 articles · 9mo ago
GodRAT activity active with steganographic delivery
Exploitation ObservedGodRAT activity remains active as recently as August 12, 2025, using steganography to conceal shellcode inside image files and download malware from a command-and-control server.
Show sources
- New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code — thehackernews.com — 19.08.2025 17:33
-
19.08.2025 17:33 1 articles · 9mo ago
Technical analysis discloses a new GodRAT campaign
Initial DisclosureA technical analysis identifies a campaign targeting financial institutions, including trading and brokerage firms, that distributes malicious .SCR files disguised as financial documents via Skype messenger and notes GodRAT client and builder source code uploaded to VirusTotal in late July 2024.
Show sources
- New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code — thehackernews.com — 19.08.2025 17:33