GravityRAT Malware Targets Windows, Android, and macOS Systems

A sophisticated multi-platform remote access trojan known as GravityRAT continues to pose a significant threat to Windows, Android, and macOS systems, with particularly aggressive targeting of Indian military, government, and defense entities.

The espionage-focused malware, attributed to Pakistani state-sponsored threat actors with tactical overlaps to Transparent Tribe (APT36), represents a persistent and evolving cyber threat that has been active for nearly a decade.​

GravityRAT distinguishes itself from conventional remote access trojans through its cross-platform capabilities and sophisticated anti-detection mechanisms.

The malware has been developed using multiple programming languages including .NET, Python, and Electron, allowing it to seamlessly operate across different operating systems while maintaining the same command-and-control infrastructure.

Its operators have consistently expanded the malware’s functionality, transforming it into a formidable tool for long-term surveillance operations.​

Patient Social Engineering

Unlike mass phishing campaigns that characterize many malware distribution efforts, GravityRAT relies on carefully orchestrated spear-phishing and social engineering tactics.

The malware typically arrives through malicious Office documents containing embedded macros or exploits, while Android variants disguise themselves as legitimate applications such as secure messaging platforms, file-sharing tools, and media players.

Recent campaigns have featured trojanized apps masquerading as encrypted messengers like BingeChat, Chatico, and SoSafe Chat, distributed through third-party websites and social media channels.​

The threat actors behind GravityRAT demonstrate remarkable patience, cultivating relationships with targets through social media platforms before delivering malicious payloads.

This methodical approach has proven significantly more effective than traditional mass distribution techniques, enabling the attackers to compromise high-value targets within military organizations, government agencies, defense contractors, and police departments across the Indian subcontinent.

GravityRAT’s most distinctive technical feature lies in its extensive anti-virtualization and anti-sandbox capabilities.

Researchers have identified seven different virtual machine detection methods employed by the malware, including BIOS version checks, hypervisor artifact searches, CPU core counting, and notably, CPU temperature queries through Windows Management Instrumentation.

This temperature check proves particularly effective because most hypervisors, including Hyper-V, VMware Fusion, VirtualBox, KVM, and Xen, fail to support temperature monitoring, immediately revealing virtual environments.

GravityRAT retrieves the MCC and MNC of the SIM card operator, the SIM card’s country ISO code, the name of the current network operator, and the current network’s ISO code.

Once successfully deployed on physical systems, GravityRAT establishes persistence through scheduled tasks and begins systematic data collection operations.

On Android devices, the malware demonstrates particularly aggressive behavior, exfiltrating SMS messages, call logs, sensitive files with extensions such as .jpg, .pdf, and .txt, and critically, WhatsApp backups.

The malware communicates with its command-and-control infrastructure via encrypted HTTPS channels, transmitting stolen data in batched ZIP archives while receiving instructions through a sophisticated administration panel called GravityAdmin.​

Mitigations

Organizations facing potential GravityRAT threats must implement multi-layered defense strategies. Updated endpoint detection and response (EDR) solutions, behavioral monitoring systems, and strict application installation policies are essential for prevention.

ANY.RUN’s Threat Intelligence Lookup service enables security teams to accelerate indicator of compromise correlation, quickly identifying GravityRAT indicators across infrastructure through sandbox analysis sessions and YARA rule-based hunting.​

The Interactive Sandbox environment provides isolated instrumentation for safely analyzing suspicious files without risking production systems, proving invaluable for detecting GravityRAT’s sophisticated evasion techniques.

Given the malware’s ability to bypass automated detection systems, security professionals must combine technological solutions with user education, emphasizing the critical importance of installing applications only from trusted sources and maintaining vigilance against targeted social engineering attempts.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.