Thursday, May 15, 2025
HomeComputer SecurityObliqueRAT - A New RAT Malware Distributed Through Weaponized Office Documents Targeting...

ObliqueRAT – A New RAT Malware Distributed Through Weaponized Office Documents Targeting Government Organizations

Published on

SIEM as a Service

Follow Us on Google News

A new malware campaign dubbed ObliqueRAT using malicious Microsoft Office documents to target government organizations in Southeast Asia.

Researchers believe that the ObliqueRAT campaign linked with the CrimsonRAT campaign as they share the same similar maldocs and macros.

In this campaign, attackers use phishing Email messages with weaponized Microsoft Office documents to deliver the ObliqueRAT malware.

- Advertisement - Google News

ObliqueRAT Infection Chain

The malware reaches the endpoints in the form of weaponized Microsoft Word documents, with the file names “Company-Terms.doc & DOT_JD_GM.doc“.

If the user opens the document it asks for a password to view the contents of the document. Once the correct password is entered, the VB script in the malicious document gets activated.

ObliqueRAT

The malicious script then creates a shortcut in the Start-Up directory to achieve persistence if the machine is rebooted.

The second stage of the payload is ObliqueRAT which has various features & functions, the RAT communicates with the C&C server and then execute the commands.

The malware checks for the process named “Oblique” running on the infected machine, if already process is running then RAT will stop the execution.

Next, it collects the system information and sent to the command and control server. Also, the malware has a list of blacklisted usernames & computer name.

ObliqueRAT

If the blacklisted values match then it stops execution on the infected computer. The check is to avoid malware execution in Sandbox based detection system.

The communication between the C&C server is hardcoded, it hides the C&C IP address and the port number. It receives various command codes from the control server and performs functionalities.

Cisco Talos researchers also “discovered another variation of the ObliqueRAT attack distributed via a malicious dropper. The malicious dropper contains 2 EXEs embedded in it that will be dropped to disk during execution to complete the infection chain.”

ObliqueRAT Capabilities

  • Able to execute commands on the infected system
  • Exfiltrate files from the computer
  • An Attacker can drop additional files
  • Able to terminate any running process
Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Coinbase Data Breach – Customers Personal Info, Government‑ID & Transaction Data Exposed

Coinbase, the largest cryptocurrency exchange in the United States, has disclosed a significant cybersecurity...

Inside Turla’s Uroboros Infrastructure and Tactics Revealed

In a nation-state cyber espionage, a recent static analysis of the Uroboros rootkit, attributed...

CISA Alerts on Five Active Zero-Day Windows Vulnerabilities Being Exploited

Cybersecurity professionals and network defenders, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has...

Intruder vs. Acunetix vs. Attaxion: Comparing Vulnerability Management Solutions

The vulnerability management market is projected to reach US$24.08 billion by 2030, with numerous...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Threat Actors Exploit Open Source Packages to Deploy Malware in Supply Chain Attacks

The Socket Threat Research Team has uncovered a surge in supply chain attacks where...

Xanthorox Emerging BlackHat AI Tool Empowering Hackers in Phishing and Malware Campaigns

Artificial intelligence platform named Xanthorox has emerged as a potent new tool for cybercriminals,...

Weaponized Google Calendar Invites Deliver Malicious Payload Using a Single Character

Security researchers have unearthed a sophisticated malware distribution method leveraging Google Calendar invites to...