An original, full-stack malware-as-a-service (MaaS) platform gives cyberattackers all they need to compromise an organization's enterprise networks, demonstrating how it's becoming less expensive to develop a cybercriminal business with custom malware than it is to pay off a mortgage.
Researchers from SOCRadar discovered VectraRAT, a previously undocumented platform that includes a full-featured Windows implant, command-and-control (C2) infrastructure, and an operator panel built entirely from scratch rather than based on existing malware, according to a new report published. This sets it apart from other MaaS platforms designed for initial access into an organization's network, which typically leverage and build upon other malware, according to the report.
"Most remote access tools sold on crimeware forums are borrowed goods. A leaked AsyncRAT build, a cracked XWorm license, a QuasarRAT fork with a new icon and a new name," according to SOCRadar's report.
VectraRAT is a different case, however, in which "every layer of it, the Linux control server, the Windows implant, the protocol between them, the licensing that keeps operators paying, was written by the same developer," according to the report. "None of it had been publicly documented." And using it costs customers only $250 per month.