FF News Logo
Friday, October 03, 2025
ITC Vegas

Kaspersky Detected a New Remote Access Trojan Targeting Financial Institutions Through Skype Messenger

Kaspersky’s Global Research and Analysis Team (GReAT) has uncovered GodRAT — a new Remote Access Trojan distributed via malicious screensaver files disguised as financial documents and delivered through Skype messenger until March 2025, subsequently transitioning to other channels. SMBs in UAE, Hong Kong, Jordan and Lebanon were targeted throughout this campaign.

The threat actor deployed a newly identified Remote Access Trojan (RAT) named GodRAT, which was found in a client’s source code on a popular online scanner, where it was uploaded in July, 2024. The archive, titled GodRAT V3.5_______dll.rar, also includes the GodRAT builder, capable of generating both executable and DLL payloads. This builder allows attackers to disguise the malicious payload by selecting legitimate process names (e.g. svchost.exe, cmd.exe, wscript.exe) for code injection and saving the final file in various formats, including .exe, .com, .bat, .scr, and .pif.

To evade detection, the attackers used steganography to embed shellcode within image files depicting financial data. This shellcode downloads the GodRAT malware from a Command-and-Control (C2) server. The RAT then establishes a TCP connection to the C2 server using the port specified in its configuration blob. It collects operating system details, local hostname, malware process name and process ID, the user account associated with the malware process, installed antivirus software, and the presence of a capture driver.

GodRAT supports additional plugins, and once installed, the attackers utilized the FileManager plugin to explore the victim’s systems and deployed password stealers targeting Chrome and Microsoft Edge to extract credentials. In addition to GodRAT, they also employed AsyncRAT as a secondary implant to maintain prolonged access.

“GodRAT appears to be an evolution of AwesomePuppet, which was reported by Kaspersky in 2023 and is likely linked to the Winnti APT. Its distribution methods, rare command-line parameters, code similarities with Gh0st RAT, and shared artifacts — such as a distinctive fingerprint header — suggest a common origin. Despite being nearly two decades old, legacy implant codebases like Gh0st RAT continue to be actively used by threat actors, often customized and rebuilt to target a wide range of victims. The discovery of GodRAT demonstrates how such long-known tools can remain relevant in today’s cybersecurity landscape,” comments Saurabh Sharma, Security Researcher within Kaspersky’s Global Research and Analysis Team.

People In This Post

Companies In This Post

  1. EXCLUSIVE: “Game Changer” – Andy Lyons, Freemarket in ‘The Fintech Magazine’ Read more
  2. Binance Launches The Blockchain 100 Award to Honor Top Creators Driving Blockchain Innovation Read more
  3. MAPFRE AM Appoints Ismael García Puente as the New Deputy Director of Investment Strategy Read more
  4. Open Banking Startup Yavrio Named One of CNBC’s UK Top Fintechs 2025, Cementing Leadership in Enterprise Finance Read more
  5. Crypto Wallet Adoption is Skewing Affluent as Dreams of Financial Freedom Fades Read more
Gitex Global