{
  "name": "An In-Depth Analysis of Novel KarstoRAT Malware",
  "slug": "an-in-depth-analysis-of-novel-karstorat-malware",
  "description": "KarstoRAT is a newly identified remote access trojan that emerged in early 2026, combining surveillance, credential theft, and remote command execution capabilities. The malware supports extensive post-compromise operations including system reconnaissance, screenshot and audio capture, webcam monitoring, keylogging, and token theft. It communicates with a C2 server at 212.227.65[.]132 using HTTP protocols with the user agent 'SecurityNotifier'. Distribution occurs through gaming-themed lure pages targeting Roblox players and FPS/GTA modders via fake cheat loaders. KarstoRAT employs multiple persistence mechanisms through registry keys, scheduled tasks, and startup folders, while featuring a UAC bypass using the fodhelper.exe technique. The malware has not been publicly advertised on cybercrime forums, suggesting private development and limited operator use rather than commodity distribution.",
  "published": "2026-04-30T14:20:46.832000+00:00",
  "created_at": "2026-05-04T11:29:54.898000+00:00",
  "modified_at": "2026-05-04T09:29:54+00:00",
  "created_at_opencti": "2026-05-04T11:29:54.898000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "discord token stealer",
    "fodhelper exploit",
    "gaming lure pages",
    "karstorat",
    "webcam surveillance"
  ],
  "tags": [
    "2026-04-30",
    "discord token stealer",
    "fodhelper exploit",
    "gaming lure pages",
    "karstorat",
    "webcam surveillance"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "1f5409fc-24e0-432a-bffd-c6d6d6898bd4",
        "name": "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b"
      },
      {
        "id": "409048e2-c29b-48ef-a483-162d7ba17d62",
        "name": "839e882551258bf34e5c5105147f7198af2daf7e579d7d4a8c5f1f105966fd7e"
      },
      {
        "id": "bf32799c-10bb-454d-b9d5-31860504cc02",
        "name": "ee5b0c1f0015b9f59e34ef8017ead6e83259b32c4b0e07dc1f894b0d407094a3"
      },
      {
        "id": "b734a67a-5b6f-42d6-83cf-2d33e385ab40",
        "name": "aca3f2902307c5ebdb43811b74000783d61b6ad29d7796bb8107d8b1b38d76a3"
      },
      {
        "id": "27a0a3bf-5b9d-408a-afaf-2bf66e31c598",
        "name": "hallucinative-shabbily-olga.ngrok-free.dev"
      },
      {
        "id": "49a4edbe-018c-4aa9-ac59-bfc193df5e5d",
        "name": "07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "d048ac4b-dd28-4c66-b62b-fe25cefef481",
        "name": "T1548.002"
      },
      {
        "id": "f48eade0-2f45-4ff7-aa61-8ba887887f81",
        "name": "T1123"
      },
      {
        "id": "3eb6d0bc-8d5f-4192-a97e-0a7bbbb5d0a3",
        "name": "T1491"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "269fca28-cdea-40b4-ae42-8246ad31a84a",
        "name": "T1125"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "9012ed9b-a671-4d01-b475-ee75b1dce890",
        "name": "KarstoRAT",
        "slug": "karstorat"
      }
    ],
    "observables": [
      {
        "id": "0479c9ee-88b2-4440-bbc5-94213e8d58a3",
        "name": "hallucinative-shabbily-olga.ngrok-free.dev"
      },
      {
        "id": "",
        "name": "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b"
      },
      {
        "id": "",
        "name": "839e882551258bf34e5c5105147f7198af2daf7e579d7d4a8c5f1f105966fd7e"
      },
      {
        "id": "",
        "name": "ee5b0c1f0015b9f59e34ef8017ead6e83259b32c4b0e07dc1f894b0d407094a3"
      },
      {
        "id": "",
        "name": "aca3f2902307c5ebdb43811b74000783d61b6ad29d7796bb8107d8b1b38d76a3"
      },
      {
        "id": "",
        "name": "07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "hallucinative-shabbily-olga.ngrok-free.dev"
      }
    ]
  },
  "external_refs": [
    {
      "id": "8a2ebe01-9740-4e2a-a2bd-5c7301952840",
      "standard_id": "external-reference--141059bd-1877-5cef-9a43-bd8f04aee7dd",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.levelblue.com/hubfs/Web/Library/Documents_pdf/TTR-Spotlight-Novel-KarstoRAT-Malware.pdf",
      "hash": null,
      "external_id": null,
      "created": "2026-05-04T11:29:54.826Z",
      "modified": "2026-05-04T11:29:54.826Z",
      "createdById": null
    },
    {
      "id": "33c2b5e9-afe5-4750-909d-f80d85573b1b",
      "standard_id": "external-reference--dec9a976-5972-5acd-a13f-ea29abdef676",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69f3653e6f25eb53d5d343b1",
      "hash": null,
      "external_id": "69f3653e6f25eb53d5d343b1",
      "created": "2026-05-04T11:29:54.790Z",
      "modified": "2026-05-04T11:29:54.790Z",
      "createdById": null
    }
  ]
}