Cisco Talos identified JhoneRAT in January 2020. The RAT is delivered through cloud services (Google Drive) and also submits stolen data to them (Google Drive, Twitter, ImgBB, GoogleForms). The actors using JhoneRAT target Saudi Arabia, Iraq, Egypt, Libya, Algeria, Morocco, Tunisia, Oman, Yemen, Syria, UAE, Kuwait, Bahrain and Lebanon.
|2020-12-21 ⋅ Cisco Talos ⋅ |
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
|2020-12-09 ⋅ Cybereason ⋅ |
MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign
JhoneRAT Molerat Loader Pierogi Quasar RAT Spark
|2020-03-03 ⋅ Palo Alto Networks Unit 42 ⋅ |
Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
Downeks JhoneRAT Molerat Loader Spark
|2020-01-16 ⋅ Cisco Talos ⋅ |
JhoneRAT: Cloud based python RAT targeting Middle Eastern countries
There is no Yara-Signature yet.