#PureRAT
LightNews LightNews
threadlinqs.bsky.social
PureRAT and PureLogs hit Japan: signed Excel.exe sideloads, modified Donut, and a BYOVD driver that kills EDR. https://intel.threadlinqs.com/threat/TL-2026-5841?utm_source=bluesky #ThreatIntel #PureRAT #PureLogs
November 12, 2026 at 9:02 AM
threadlinqs.bsky.social
VasyGrek's fake reconciliation acts hide PureHVNC inside RegAsm.exe. Three suspects now arrested. https://intel.threadlinqs.com/threat/TL-2026-5225?utm_source=bluesky #ThreatIntel #PureRAT #PureCrypter #PureLogs
November 4, 2026 at 9:44 AM
abuse-ch.bsky.social
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️.
October 28, 2026 at 7:47 AM
infosecbot.bsky.social
INTEL DROP

Top 20 tools in Total Insights detection pipeline, ranked by the number of distinct IPs observed today per family.

C2 by IP count:
1,200+ CyberStrikeAI
500+ VShell
400+ PureRAT
300+ Cobalt Strike
300+ Sliver…

— from @teamcymru_S2 (https://x.com/teamcymru_S2/status/2113624963877925074)
team-cymru.com
team-cymru.com
t.co
October 23, 2026 at 1:42 PM
bomccss.bsky.social
■ダウンロード
Complete_Product_Condition_Review_mp4_4f8a1b63.zip
www.virustotal.com/gui/file/962...
tria.ge/261016-jedyp...
マルウェア #PureRAT
■C2
trump.sharevideocenter[.]com
(82.47.180[.]159:56001)

引用元:
x.com/tdatwja/stat...
October 16, 2026 at 11:11 AM
threadlinqs.bsky.social
Hotel staff get fake guest complaints - the RAT then finds its C2 on a blockchain smart contract. https://intel.threadlinqs.com/threat/TL-2026-3093 #ThreatIntel #TrojanSpyJSTONRESOLVERA #EtherRAT #PureRAT
Hotel-Targeted Fake Guest Complaint Phishing Delivers EtherRAT and TONResolver with Blockchain Dead-Drop C2
October 9, 2026 at 5:35 AM
threadlinqs.bsky.social
Fake complaint emails drop PureRAT/PureLogs - one loader BYOVDs a Lenovo driver to kill your EDR. https://intel.threadlinqs.com/threat/TL-2026-2652 #ThreatIntel #PureRAT #PureCoder #PureLogs
Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs
September 25, 2026 at 12:31 PM
thedailytechfeed.com
Damage request emails are now malware traps—fake docs, ZIPs, PureRAT laid bare. #Malware #Phishing #EmailSecurity #PureRAT #ThreatIntel #CyberDefense https://thedailytechfeed.com/business-emails-are-being-used-to-slip-malware-into-organizations/
September 25, 2026 at 12:24 PM
threadlinqs.bsky.social
PureRAT/PureLogs phish hits Japan/Korea via a wall of loaders and a BYOVD EDR-kill - one stealer behind it all. https://intel.threadlinqs.com/threat/TL-2026-2647 #ThreatIntel #PureRAT #PureLogs #Korean
Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)
September 25, 2026 at 5:07 AM
glitterbean.wehavecookies.social.ap.brid.gy
PureRAT-msbuild.exe--C2-Extraction--Net-Evasion-Analysis https://kitploit.com/en/tools/github/kaandemir993/purerat-msbuild.exe--c2-extraction--net-evasion-analysis
PureRAT-msbuild.exe--C2-Extraction--Net-Evasion-Analysis — Reverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and VBScript persistence mechanisms. | Kitploit
Reverse engineering analysis of PureRAT RAT abusing msbuild.exe, extracting C2 infrastructure, .NET evasion APIs, file system manipulation, and VBScript persistence mechanisms.
kitploit.com
September 22, 2026 at 1:38 PM
infosecbot.bsky.social
Reverse engineering analysis of PureRAT, a multi-stage RAT that executes via msbuild.exe and communicates with C2 servers at
https://
pure8s.ddnsfree.com and 52.241.248.38.

Uses .NET evasion techniques (DisableNativeImageLoad),…

— from @ipurple (https://x.com/ipurple/status/2102336812282675637)
September 22, 2026 at 10:00 AM
bolhasec.com
Notícia da BleepingComputer

"From infostealer to full RAT: dissecting the PureRAT attack chain" #bolhasec
From infostealer to full RAT: dissecting the PureRAT attack chain
Researchers map a campaign that escalated from a Python infostealer to a full PureRAT backdoor — loaders, evasions, and TLS-pinned C2. Join Huntress Labs' Tradecraft Tuesday for deep technical walkthr...
www.bleepingcomputer.com
November 3, 2025 at 10:30 PM
ethicalhackingnews.bsky.social
#Cybersecurity #ITSecurity #InfoSec #CyberNews #Hacking #EthicalHackingNews
Credential Theft and Remote Access Surge as AllaKore, PureRAT, and Hijack Loader Proliferate in a Wave of Financial Fraud
www.ethicalhackingnews.com
July 22, 2025 at 5:09 PM
qiancx.bsky.social
勒索时代的隐秘战场：AllaKore、PureRAT与Hijack Loader如何引爆远程访问和凭证窃取浪潮

https://qian.cx/posts/0E2A36E7-AC83-4C9F-872E-1FAF980F2D08
October 30, 2025 at 1:49 AM
it4intserver.bsky.social
iT4iNT SERVER Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware VDS VPS Cloud #Cybersecurity #Phishing #Malware #HotelSecurity #ClickFix
Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware
Cybersecurity researchers have called attention to a massive phishing campaign targeting the hospitality industry that lures hotel managers to ClickFix-style pages and harvest their credentials by deploying malware like PureRAT. "The attacker's modus operandi involved using a compromised email account to send malicious messages to multiple hotel establishments," Sekoia said. "This campaign
dlvr.it
November 10, 2025 at 12:21 PM
dasgeldco.bsky.social
Massiver Anstieg von PureRAT Malware im Jahr 2025: Russische Unternehmen im Visier durch PureLogs-Spionage

https://dasgeld.co/posts/E51CC74A-BCF6-4E88-927D-B746316E02F1
July 2, 2025 at 4:25 PM
jbhall56.bsky.social
"The phishing emails contain malicious Scalable Vector Graphics (SVG) files designed to trick recipients into opening harmful attachments," Fortinet FortiGuard Labs researcher Yurren Wan said in a report shared with The Hacker News. thehackernews.com/2025/09/rese...
Researchers Expose Phishing Threats Distributing CountLoader and PureRAT
SVG phishing emails drop CountLoader to deploy Amatera Stealer and PureMiner in Ukrainian government attack.
thehackernews.com
September 27, 2025 at 2:36 PM
campuscodi.risky.biz
-CISA and NIST propose new LEV vuln metric
-Unpatched Foscam bugs
-Go crypto has a security audit
-New SCC cyber industry group
-New ENISA NIS2 handbook
-OffensiveCon 2025 videos
-Malware reports on ELPACO-team ransomware, 3AM ransomware, PureRAT, Hannibal Stealer
May 21, 2025 at 9:25 AM
pepikhipik.bsky.social
Útočníci s oblibou využívají snadno dostupné nástroje PureRAT a Phantom Stealer (HP) www.itbiz.cz/utocnici-s-o...
February 2, 2026 at 5:53 AM
netresec.infosec.exchange.ap.brid.gy
Update:
The two `zgRAT` IOCs that are less than 6 months old were reported as false positives on ThreatFox. The first one has now been re-classified as PureRAT, while the second one is marked as (Unknown malware)[https://threatfox.abuse.ch/ioc/1750083/]. The reason for the `Unknown` tag is […]
Original post on infosec.exchange
infosec.exchange
July 31, 2026 at 7:45 AM
netresec.infosec.exchange.ap.brid.gy
Update:
The two `zgRAT` IOCs that are less than 6 months old were reported as false positives on ThreatFox. The first one has now been re-classified as PureRAT, while the second one is marked as (Unknown malware)[https://threatfox.abuse.ch/ioc/1750083/]. The reason for the `Unknown` tag is […]
Original post on infosec.exchange
infosec.exchange
July 31, 2026 at 7:45 AM
netresec.infosec.exchange.ap.brid.gy
More on why you shouldn't use the label/tag zgRAT
https://netresec.com/?b=267e877
PureLogs, PureRAT and misleading zgRAT
Please stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isnt a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family as PureLogs, while others argue that zgRAT should be mapped to PureRAT. There is also a blog post by[...]
www.netresec.com
July 30, 2026 at 3:14 PM
netresec.infosec.exchange.ap.brid.gy
The broken TLS implementation in `PureRAT` has been described in our blog post PureRAT = ResolverRAT = PureHVNC. Examples of such broken TLS traffic to `196.251.86.238:56001` can be found on JoeSandbox and ANY.RUN.
PureRAT = ResolverRAT = PureHVNC
PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone elses PC. PureRAT provides the following features to an attacker: See the victims user interfaceInteract with the victim PC using mouse and keyboardView the webcamListen to the microphoneRecord keystrokes[...]
www.netresec.com
July 30, 2026 at 3:10 PM
netresec.infosec.exchange.ap.brid.gy
FlowCarp classifies `79.110.49.15:39001` as `PureMiner` and the other ones as `PureRAT` or `TLS, PureRAT`. The `TLS` prefix means that PureRAT C2 traffic is encrypted using TLS. Some of the traffic sent to FlowCarp for `196.251.86.238:56001` used proper TLS […]

[Original post on infosec.exchange]
curl -s --data-binary @ThreatFox-zgRAT.pcap https://demo.flowcarp.com | jq -s -c 'map(select(.event_type=="alert")|[(.dest_ip + ":" + (.dest_port|tostring)), .alert.signature])|unique[]' ["196.251.86.238:56001","MALWARE protocol detected: PureRAT"] ["196.251.86.238:56001","MALWARE protocol detected: TLS, PureRAT"] ["79.110.49.15:39001","MALWARE protocol detected: PureMiner"] ["89.23.103.60:7001","MALWARE protocol detected: TLS, PureRAT"]
July 30, 2026 at 3:08 PM
netresec.infosec.exchange.ap.brid.gy
Only 3 IOCs have been posted to ThreatFox for the confusing catch-all label `zgRAT` in the past 12 months. Let's clear up any issues and figure out what they actually are.

`89.23.103.60:7001` is `PureRAT`
`194.169.175.191:39002` is `PureMiner` (also tagged […]

[Original post on infosec.exchange]
PureRAT and PureMiner traffic on ThreatFox: 2026-03-05 15:06:22 89.23.103.60:7001 zgRAT zgrat PeterGabaldon 2026-02-18 07:34:51 194.169.175.191:39002 zgRAT API-BASE64 execution NETREACTOR persistence PUREMINER zgrat Neiki 2025-10-16 05:38:45 196.251.86.238:56001 zgRAT RAT zgrat burger
July 30, 2026 at 3:03 PM