A cybercrime campaign has brought VenomRAT a remote access trojan (RAT) derived from the open-source Quasar RAT back into the spotlight, with the addition of new post-exploitation tools targeting individuals for financial gain.
Security researchers have uncovered a sophisticated distribution method using a spoofed Bitdefender Windows Antivirus download page, designed to mislead users and deliver a trio of malicious payloads: VenomRAT, StormKitty, and SilentTrinity.
The malicious domain, “bitdefender-download[.]com,” mimics the appearance of Bitdefender’s official download portal, but with subtle discrepancies such as the absence of references to a free version, which can deceive even attentive users.
Clicking the download link initiates a chain that delivers a ZIP archive from a Bitbucket URL, which then redirects to Amazon S3 for hosting.
Analysis of the bundled executable, StoreInstaller.exe, has revealed embedded configurations for VenomRAT, as well as code associated with the open-source frameworks StormKitty (a credential stealer) and SilentTrinity (a post-exploitation toolkit).
Multi-Stage Attack with Open-Source Tools
Once installed, VenomRAT establishes both initial and persistent access to the compromised system, laying the groundwork for broader exploitation.
Within moments, StormKitty scours the device for credentials and digital wallet information, while SilentTrinity provides attackers with stealthy, ongoing access, making it possible to return to victim systems repeatedly or to sell access to other cybercriminals.
The modular nature of these open-source tools, coupled with their rapid integration, has enabled cybercriminals to amplify their attack efficiency and stealth, demonstrating a clear shift towards the industrialization of malware deployment.
Threat intelligence analysis has linked multiple samples of VenomRAT to a reused command-and-control (C2) infrastructure, including distinctive configurations such as IP address 67.217.228[.]160:4449.
Additional investigation using Shodan’s fingerprinting capability has identified a network of C2 endpoints using similar RDP service configurations, suggesting a well-coordinated campaign managed by a single threat actor or group.
The campaign’s infrastructure extends beyond the spoofed antivirus site. Researchers found additional delivery vectors via direct download links and repositories on platforms such as GitHub and direct hosting services, pointing to an adaptive and pervasive threat ecosystem.
Moreover, the actors behind this campaign have expanded their tactics to include phishing domains imitating banks and IT service providers, with credential harvesting sites designed to mimic prominent portals, such as Armenia’s IDBank and the Royal Bank of Canada.
These sites leverage similar infrastructure often protected by Cloudflare and registered with privacy-focused providers making attribution and takedown efforts challenging.
Escalating Risks
According to the Report, The discovery of this campaign underscores a growing trend: threat actors are leveraging open-source frameworks not only to develop new malware variants but also to streamline the deployment of multi-stage attacks.
This strategy allows for rapid updates, easy customization, and global scalability, all while retaining a low profile by piggybacking on reputable hosting providers and established cloud services.
For end-users, these threats emphasize the necessity of heightened vigilance, especially when downloading security software or entering sensitive credentials online.
Verifying website authenticity, practicing cautious internet hygiene, and maintaining updated security solutions are vital steps in mitigating the risk posed by increasingly sophisticated, open-source-powered malware operations.
As attackers continue to refine their tactics, the line between targeted enterprise attacks and large-scale campaigns against individual users grows ever thinner, reinforcing the need for widespread awareness and proactive defense.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
 derived from the open-source Quasar RAT.){kind=link}