HiatusRAT Malware Attack Routers to Gain Remote Access & Download Files

Lumen’s Black Lotus Labs recently witnessed that Hackers are currently targeting DrayTek Vigor router models 2960 and 3900 in a campaign known as ‘Hiatus’. 

The primary goal of hackers is to steal data from victims and establish a covert proxy network for cyberespionage purposes.

Vigor devices from DrayTek are business-class VPN routers used for remote access to corporate networks by small and medium-sized organizations.

It has been estimated that about 4,100 DrayTek routers are vulnerable on the internet as of mid-February 2023. It is estimated that this represents approximately 2% of the total number of DrayTek routers that are exposed.

There are three key components involved in this latest hacking campaign, which began in July 2022 and is still ongoing to this day:-

  • A malicious bash script
  • A malware named “HiatusRAT,”
  • The legitimate ‘tcpdump,’

The most interesting part of the campaign is its HiatusRAT component, which gives the campaign its name in the first place. There are several purposes for which this tool is used and here they are mentioned below:-

For additional payloads downloading

On the breached device running commands 

Converting the device into a SOCKS5 proxy

Technical Analysis

HiatusRAT has infected approximately a hundred businesses mainly in the following regions:-

  • America
  • Europe
  • North America

It is not yet known how DrayTek routers were initially compromised, and even scientists at this time are unable to determine how that occurred.

The threat actors download three components to the router by deploying a bash script, and they do so after they gain access to the device. 

As part of this script, the first step is to download the HiatusRAT to ‘/database/.updata’ and run it from there. Upon detecting that a process is already running on port 8816, the malware begins listening for it and kills it.

As part of HiatusRAT’s monitoring system, the threat actor can track the status of the compromised router by sending a heartbeat POST to the C2 every eight hours.

The following are some of the industries that have been negatively impacted:-

  • Pharmaceuticals
  • IT services
  • Consulting firms
  • Municipal government

Data Collected

From the breached device, the following information is collected:

  • MAC address
  • Kernel version
  • System architecture
  • Firmware version
  • Router IP address
  • Local IP address
  • MACs of devices on adjacent LAN
  • Mount points
  • Directory-level path locations
  • Filesystem type
  • Process names
  • IDs
  • UIDs
  • Arguments


As a result of Black Lotus Labs’ reverse engineering analysis of the malware, the following features have been revealed:-

  • config: From the C2, load the new configuration.
  • shell: On the infected device, spawn a remote shell.
  • file: C2 files can be accessed, deleted, or exfiltrated.
  • executor: Retrieve a file from the C2 and execute it.
  • script: From the C2, run a script.
  • tcp_forward: Whenever TCP data is received on a host’s listening port, forward it to a forwarding address.
  • socks5: On the compromised router, set up a SOCKS v5 proxy server.
  • quit: Put an end to the execution of malware.

SOCKS is used to obfuscate network traffic and mimic legitimate behavior while forwarding data from other infected machines.

A packet-capturing tool will also be installed by the bash script when it is run. With the help of this tool, TCP ports connected to mail servers and FTP connections are monitored.

Here below we have mentioned the monitored ports:-

  • Port 21 for FTP
  • Port 25 for SMTP
  • Port 110 is used by POP3
  • Port 143 is associated with the IMAP protocol

Even though Hiatus is a small campaign in scale, the impact it has on the victims can be extremely serious. Research conducted by Lumen indicates that the threat actor has deliberately maintained a small volume of attacks in order to avoid detection.

Network Security Checklist – Download Free E-Book


BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…

23 hours ago

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…

3 days ago

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…

3 days ago

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…

3 days ago

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…

3 days ago

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…

3 days ago