The final stage of the REF6598 intrusion set, uncovering a sophisticated Remote Access Trojan (RAT) named PHANTOMPULSE.
Originally delivered through malicious Obsidian plugins, this malware relies on complex evasion tactics, a blockchain-based command and control (C2) channel, and a public User Account Control (UAC) bypass to compromise Windows systems.
The binary also features strong fingerprints of AI coding assistance. The developers left behind verbose debug strings and structured step numbering such as “[STEP 1] Staged mode” which closely match the diagnostic style generated by Large Language Models.
PHANTOMPULSE RAT Bypasses UAC
PHANTOMPULSE is heavily armored against modern security software. It successfully disables the Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), and Event Tracing for Windows (ETW) using a highly evasive hardware-breakpoint technique.
Instead of patching API code in memory, the malware sets a hardware breakpoint on the target security function.
When the system tries to execute the function, a custom exception handler catches the call, spoofs a “success” response, and continues running the program. This effectively blinds signature-based memory scanners.
To ensure persistence across reboots, the malware hides its core files inside encrypted registry blobs and drops temporary files in standard user directories.
It then creates multiple scheduled tasks, disguising them as routine .NET Framework updates.
The C2 infrastructure for PHANTOMPULSE is decentralized and relies on reading data from public blockchains. The malware queries three different blockscout providers for Ethereum, Base, and Optimism ledgers.
It locates a specific wallet address, reads the latest transaction input, and decrypts the data to find its active C2 URL.
Interestingly, this creates a major vulnerability for the attackers. The malware does not verify who sent the transaction.
Network defenders can send their own transaction containing a sinkhole URL, forcing every active PHANTOMPULSE implant to redirect its traffic to a secure, defender-controlled server.
Once the malware establishes communication, it inventories the system. It checks for standard antivirus software and specifically hunts for high-value applications like cryptocurrency wallets, encrypted messengers, and two-factor authentication tools.
According to Elastic research, PHANTOMPULSE relies on a known UAC bypass called the “schuac” technique. It abuses a Windows maintenance COM interface that is automatically granted elevated permissions.
The malware uses this trusted interface to interact with the Task Scheduler, registering a temporary elevated task.
This task immediately relaunches the malware with full administrative rights, allowing it to bypass standard user restrictions without triggering security prompts.
Cybersecurity analysts attribute this campaign to DPRK-aligned threat actors, specifically to clusters such as BlueNoroff.
The heavy focus on cryptocurrency wallets, overlap with macOS malware variants, and the abuse of blockchain networks for C2 resolution are known hallmarks of North Korean operations.
Defenders can actively hunt for new infrastructure by searching blockchain ledgers for the unique 0x580c0x580c hex signature, which is consistently produced by the malware’s C2 encryption routine.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 named PHANTOMPULSE.){kind=link}