Winsage
September 8, 2025
A recent investigation by cybersecurity experts revealed a sophisticated phishing campaign utilizing a new strain of malware called MostereRAT, which targets Microsoft Windows systems. This Remote Access Trojan (RAT) allows attackers extensive control over compromised devices and employs advanced evasion techniques, including being crafted in the Easy Programming Language (EPL). MostereRAT can disable security tools, obstruct antivirus traffic, and establish secure communications with its command-and-control server through mutual TLS (mTLS).
The attack begins with phishing emails aimed at Japanese users, leading to the download of a Word document that contains a concealed archive. This prompts the user to execute an embedded executable, activating the malware, which installs itself in the system directory and creates services with SYSTEM-level privileges. It also displays a deceptive message in Simplified Chinese to further spread the malware.
MostereRAT can disable Windows Update, terminate antivirus processes, and impersonate the TrustedInstaller account to escalate privileges. Its functionalities include keylogging, system information collection, downloading and executing payloads, creating hidden administrator accounts, and running remote access tools like AnyDesk and TightVNC. Some components of MostereRAT's infrastructure were previously linked to a banking trojan reported in 2020.
