New technical details about PHANTOMPULSE, a sophisticated remote access trojan (RAT) used in multi-stage intrusions targeting Windows environments.
The malware represents the final payload in an attack chain previously linked to Obsidian plugin abuse and in-memory loaders, but this latest analysis focuses on its advanced post-exploitation capabilities.
PHANTOMPULSE stands out for combining multiple stealth techniques, including process injection, User Account Control (UAC) bypass, and a decentralized blockchain-based command-and-control (C2) mechanism. Together, these features enable persistent, covert access to compromised systems.
One of the most notable capabilities is its use of three distinct process injection techniques. Depending on the payload type, the malware deploys module stomping, manual DLL mapping, or a debug-driven execution method derived from public proof-of-concept tools.
These techniques allow attackers to execute malicious code within legitimate processes such as explorer.exe or dllhost.exe, significantly reducing detection by endpoint security tools.
To evade defenses, PHANTOMPULSE uses direct system calls instead of standard Windows APIs. This bypasses user-mode hooks commonly deployed by EDR solutions.
Elastic Security Labs’s prior coverage of REF6598 documented an intrusion set whose Windows toolchain landed via Obsidian plugin abuse, escalated via an in-memory PE loader (PHANTOMPULL).
Additionally, it implements a unique hardware breakpoint (HWBP) mechanism to disable key security protections, including AMSI (Antimalware Scan Interface), Windows Lockdown Policy (WLDP), and Event Tracing for Windows (ETW).
Rather than modifying code in memory, the malware intercepts execution at runtime and spoofs clean return values, making detection far more difficult.
PHANTOMPULSE RAT Uses UAC
Another critical feature is its blockchain-based C2 resolution. Instead of relying on static domains, PHANTOMPULSE retrieves its C2 server address from transaction data on Ethereum, Base, and Optimism networks.
The malware extracts and decrypts the “input” field of recent transactions tied to a hardcoded wallet address. However, researchers identified a major weakness: the resolver does not verify the transaction sender.
This means defenders can potentially hijack the communication channel by submitting a single crafted transaction, effectively sinkholing all infected hosts.
Persistence is maintained through multiple scheduled tasks that execute a malicious DLL via rundll32.exe at system startup and user logon. The malware also supports self-healing, automatically restoring deleted components or tasks during periodic checks.
Privilege escalation is achieved using the publicly known “schuac” UAC bypass technique. By abusing COM interfaces such as IElevatedFactoryServer, PHANTOMPULSE can spawn elevated processes without triggering user prompts, allowing it to operate with high integrity privileges.
PHANTOMPULSE disables AMSI, the Windows Lockdown Policy code-trust check, and ETW telemetry through a single shared primitive: a hardware breakpoint planted on each API entry.
The malware also performs extensive system reconnaissance, collecting details such as OS version, hardware specs, installed applications, and security products.
It specifically checks for cryptocurrency wallets, messaging apps, and file transfer tools, indicating a focus on financially motivated operations. However, no direct credential or wallet theft functionality was observed in this variant, suggesting it acts as a staging platform for follow-on payloads.
Interestingly, the binary contains strong indicators of AI-assisted development. Debug strings reveal structured logging patterns, verbose diagnostics, and consistent function tracing artifacts commonly associated with large language model-generated code.
PHANTOMPULSE ships three injection techniques, one per payload type. The inject C2 command routes shellcode to PhantomInject, DLLs to ManualMap, and EXEs to DbgNexum.
Elastic researchers also noted overlaps with tactics used by DPRK-aligned threat groups, particularly those targeting cryptocurrency platforms. The use of blockchain-based C2, combined with cross-platform targeting and crypto wallet reconnaissance, aligns with previously reported campaigns attributed to clusters such as BlueNoroff and UNC5342.
Overall, PHANTOMPULSE demonstrates how modern malware increasingly blends publicly available offensive techniques with innovative infrastructure, creating highly evasive and resilient threats.
Its combination of injection methods, stealthy defense bypasses, and decentralized C2 highlights the growing complexity defenders must address in enterprise environments.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 used in multi-stage intrusions targeting Windows environments.){kind=link}