Tuesday, May 6, 2025
HomeComputer SecurityHackers Attack Financial Institutions & Government Organizations With "Proyecto RAT"

Hackers Attack Financial Institutions & Government Organizations With “Proyecto RAT”

Published on

SIEM as a Service

Follow Us on Google News

Security researchers observed a new campaign targeting financial institutions and governmental organizations with a customized version of a remote access tool called “Proyecto RAT”.

The payload found to be written in Visual Basic 6 and it uses Disposable E-mail Address service yopmail for its C&C communication. The yopmail is known for creating temporary inboxes.

Infection Process

According to the Trend Micro report, the attack primarily targets the organizations in the South American region, particularly in Colombia. The infection starts with a customized email sent to the target from open or compromised mail servers in the South America region.

- Advertisement - Google News

The Email contains an RTF attachment file and contains tempting subjects

  • “Hemos iniciado un proceso en su contra por violencia laboral.” (Loosely translates to “We have filed a lawsuit against you for workplace violence.”)
  • “Se hara efectivo un embargo a su(s) cuenta(s) Bancarias.” (Loosely translates to “Your banking accounts are going to be blocked.”)
  • “Almacenes exito te obsequia una tarjeta regalo virtual por valor de $500.000.” (Loosely translates to “Exito shops offer you a virtual gift worth $500.000.”)

The attachment contains shorten links that direct victims to file-sharing services, the delivery file is a macro-enabled MHTML file. The macrocode is responsible for downloading and executing the first stage payload Imminent Monitor RAT.

As the name indicates it monitors all the network activities and includes information for executing the second-stage payload. The Imminent Monitor RAT supports a wide range of monitoring activities that include spying on keyboards, File transfer, Grabbing screenshots and recording audio feeds.

Second Stage Payload – Proyecto RAT

The second stage of the payload is the “Proyecto RAT” which uses a disposable yopmail email service for C&C communication.

Based on the Trend Micro analysis report, “the malware connects to a mailbox, reads the only available email message, parses it, and then extracts the subject of the email. The C&C server URL is between the ‘¡’ characters, a character used in the Spanish language and tree email boxes has been used.”

Researchers believe that “Proyecto RAT” “is an old and limited version of the Xpert RAT — either a custom modification of Xpert RAT or malware with source code based on Xpert RAT’s.”

The attacks target South American and Colombia is the most targeted country, followed to the campaign, the recent campaigns appeared to be targeting government entities, healthcare/pharmaceutical institutions, agro-industry/food/packaging organizations.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Related Read

TA505 APT Hackers using New AndroMut Malware to Drop FlawedAmmyy RAT and Gain Remote Access

OceanLotus APT Group Uses Undetected Ratsnif Remote Trojan to Leverage Network Attack’s

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...

Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time

Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered...

Hackers Targeting Schools and Universities in New Mexico with Cyber Attacks

A major cyberattack on the Coweta County School System's computer network occurred late Friday night, which is a worrying development for New Mexico's educational institutions. The unauthorized intrusion, detected around 7:00 p.m., prompted immediate action from the school...

Initial Access Brokers Play a Vital Role in Modern Ransomware Attacks

The ransomware threat landscape has evolved dramatically in recent years, with specialized cybercriminals like...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Ransomware Attacks on Food & Agriculture Industry Surge 100% – 84 Attacks in Just 3 Months

The food and agriculture industry is facing an unprecedented wave of cybersecurity threats in...

Microsoft 365 Copilot and Office Apps Now Protected by SafeLinks at Click Time

Microsoft announced a major update aimed at bolstering the cybersecurity of its flagship AI-powered...

Hackers Targeting Schools and Universities in New Mexico with Cyber Attacks

A major cyberattack on the Coweta County School System's computer network occurred late Friday night, which is a worrying development for New Mexico's educational institutions. The unauthorized intrusion, detected around 7:00 p.m., prompted immediate action from the school...