Morphisec identifies ResolverRAT, a remote access trojan with advanced capabilities and layered evasion techniques. Read on for a full threat analysis.

Organizations in the healthcare and pharmaceutical sectors have been targeted with ResolverRAT, a new malware family with advanced capabilities.

ResolverRAT targets healthcare and pharma via localized phishing; uses advanced stealth tactics to ensure persistence and evade detection.

ResolverRAT targets healthcare organizations using advanced evasion techniques and social engineering

Morphisec identifies ResolverRAT, a remote access trojan with advanced capabilities and layered evasion techniques. Read on for a full threat analysis.

A new remote access trojan (RAT) called 'ResolverRAT' is being used against organizations globally, with the malware used in recent attacks targeting the healthcare and pharmaceutical sectors.

Un nouveau virus du nom de ResolverRAT se propage dans le monde entier. Le malware piège les entreprises du secteur de la santé et de la pharmacie avec des mails de phishing calibrés. Au terme de l'at...

A new remote access trojan (RAT) called 'ResolverRAT' is being used against organizations globally, with the malware used in recent attacks targeting the healthcare and pharmaceutical sectors.

A new Remote Access Trojan (RAT) named 'ResolverRAT' is being used against organizations worldwide, particularly targeting the healthcare and pharmaceutical sectors. This malware has been detected in recent attacks aimed at these industries. The article does not mention specific technical details or the real impacts of these attacks.

PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone else's PC. PureRAT provides the following features to an attacker: See the victims user interfaceInt...

Un nouveau virus du nom de ResolverRAT se propage dans le monde entier. Le malware piège les entreprises du secteur de la santé et de la pharmacie avec des mails de phishing calibrés. Au terme de l'at...

PureRAT is a Remote Access Trojan, which can be used by an attacker to remotely control someone elses PC. PureRAT provides the following features to an attacker: See the victims user interfaceInteract with the victim PC using mouse and keyboardView the webcamListen to the microphoneRecord keystrokes[...]

A new remote access trojan (RAT) called 'ResolverRAT' is being used against organizations globally, with the malware used in recent attacks targeting the healthcare and pharmaceutical sectors.

Organizations in the healthcare and pharmaceutical sectors have been targeted with ResolverRAT, a new malware family with advanced capabilities.

Un nuevo troyano de acceso remoto (RAT) llamado ResolverRAT está siendo utilizado para atacar a organizaciones del sector farmacéutico y sanitario en todo el

A new remote access trojan (RAT) called 'ResolverRAT' is being used against organizations globally, with the malware used in recent attacks targeting the healthcare and pharmaceutical sectors. [...]

New ResolverRAT malware targets healthcare & pharma firms globally, stealing sensitive data via sophisticated phishing attacks. #Cybersecurity #Malware #Infosec

Privacidade vs. Farmácias | Grande Firewall das Facções | Mais RMM contra o Brasil: Atera Agent | ResolverRAT

  A newly discovered remote access trojan (RAT), dubbed ResolverRAT, is being actively used in targeted cyberattacks against healthcare and pharmaceutical entities across various countries. Identified by cybersecurity researchers at Morphisec, the malware is delivered through phishing emails and uses in-memory execution tactics that allow it to bypass most traditional endpoint security solutions. The attack campaign is tailored to different regions, with phishing messages crafted in native languages such as Czech, Italian, Turkish, Hindi, Portuguese, and Indonesian. These deceptive emails often reference legal or copyright-related issues to lure users into clicking malicious links. Victims unknowingly download a legitimate executable, hpreader.exe, which is manipulated through a technique called reflective DLL loading—executing the malicious code entirely in memory. Morphisec researchers note that the attack leverages DLL side-loading: by placing a malicious DLL alongside a trusted but vulnerable application, the malware is executed when the genuine software is launched. Further, ResolverRAT exploits the .NET ‘ResourceResolve’ event to load malicious assemblies, avoiding typical flagged API calls. “This resource resolver hijacking represents malware evolution at its finest – utilizing an overlooked .NET mechanism to operate entirely within managed memory, circumventing traditional security monitoring focused on Win32 API and file system operations,” wrote Morphisec’s Nadav Lorber in a blog. ResolverRAT is equipped with multiple anti-analysis capabilities. It features a complex state machine that obfuscates its control flow and fingerprints system behaviors, making it difficult for sandboxes and debugging tools to detect or analyze. To maintain persistence, the malware writes XOR-obfuscated keys into up to 20 Windows registry entries and replicates itself in directories such as Startup and LocalAppData. It connects to its command-and-control (C2) server at irregular intervals, further concealing its network activity from pattern-based detection tools. The RAT handles commands using separate threads, which enables parallel task execution and reduces crash risks. For data exfiltration, it employs a chunked transfer method—splitting files larger than 1MB into smaller 16KB segments sent only when the socket is ready, a strategy that supports stealth and transfer recovery in poor network conditions. ResolverRAT encrypts its payload with AES-256 in CBC mode via the .NET System.Security.Cryptography library. The keys and IVs are obfuscated and only decoded at runtime. Additionally, the payload is compressed using GZip and runs exclusively in memory to minimize detection risk. While some of the phishing infrastructure resembles earlier Rhadamanthys and Lumma campaigns, Morphisec emphasized that the unique design of ResolverRAT's loader and payload warrants its classification as a new malware strain.

Il ne déclenche aucune alerte et ne laisse rien quasiment traîner sur le disque. Pourtant, ce cheval de Troie peut bel et bien accorder un accès complet à votre machine. Et a priori, il s’en sort plut...