Skip to main content
Mallory
MalwareUsed by 1 actorExploits 1 CVE

PhantomRAT

PhantomRAT is a remote access trojan associated with the threat actor PhantomCore and used in cyber-espionage campaigns, including operations targeting unnamed Russian companies. It has been delivered via spearphishing attachments and in at least one reported campaign through phishing emails containing a PDF contract lure and a password-protected RAR archive exploiting WinRAR vulnerability CVE-2023-38831 on versions earlier than 6.23. When the lure was opened, an executable launched and ultimately installed PhantomRAT; the observed sample was reported as tailored for 64-bit systems. PhantomRAT is capable of basic host reconnaissance and file transfer, including downloading files from command-and-control servers and uploading files from compromised hosts to attacker-controlled infrastructure. Reported victim data collection includes host name, user name, local IP address, and operating system version. In broader PhantomCore operations, PhantomRAT is one of several custom malware families alongside PhantomRShell, PhantomTaskShell, PhantomProxyLite, PhantomStealer, and a Phantom Control Panel. PhantomCore has used it against Windows hosts, executing commands through PowerShell and cmd.exe, disguising malware filenames as legitimate Windows components, and packing samples with UPX for obfuscation. PhantomRAT also performs anti-analysis checks by inspecting Windows registry keys, searching for the string "vmware," and calling IsDebuggerPresent(). Related reporting states PhantomCore has targeted Russian organizations and used multistage C2 infrastructure over HTTP, HTTPS, and SSH, including nonstandard ports and SSH tunneling. Attribution of PhantomCore to operators possibly located in Ukraine was assessed by F.A.C.C.T. with moderate confidence based on test sample uploads, but this attribution was not independently verified.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2023-38831Arbitrary Code Execution in WinRAR Archive File HandlingExploited in the wild

During the attacks on unnamed Russian companies, the hackers exploited a known vulnerability in the Windows file archiver tool WinRAR... Identified as CVE-2023-38831... An executable file in the archive only launched when the PDF file was opened by a user with a WinRAR version earlier than 6.23. | They named the group PhantomCore and labeled the attackers’ previously undescribed remote access malware as PhantomRAT... vulnerable systems were infected with PhantomRAT, which is capable of downloading files from a command and control (C2) server and uploading files from a compromised host to the hackers' controlled server.

via the record mediatherecord.media
THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
PhantomCore

PhantomCore develops its own malware: PhantomRAT, PhantomRShell, PhantomTaskShell, PhantomProxyLite, PhantomStealer, and the Phantom Control Panel.

via ptsecurity globalglobal.ptsecurity.com
MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

T1586.002Email AccountsEvidence1

PhantomCore gains access to corporate email accounts at legitimate companies and uses them to distribute PhantomRAT and PhantomRShell

T1587.001MalwareEvidence1

PhantomCore develops its own malware: PhantomRAT, PhantomRShell, PhantomTaskShell, PhantomProxyLite, PhantomStealer, and the Phantom Control Panel

Initial Access

1 technique
T1566.001Spearphishing AttachmentEvidence1

PhantomCore sends phishing emails with PhantomRAT and PhantomRShell attached

Execution

3 techniques
T1059.001PowerShellEvidence1
TacticExecution

Using PhantomRAT, PhantomRShell, PhantomTaskShell, and the Phantom control panel, PhantomCore runs commands in PowerShell on infected hosts

T1059.003Windows Command ShellEvidence1
TacticExecution

Using PhantomRAT, PhantomRShell, PhantomTaskShell, and the Phantom control panel, PhantomCore runs commands in the Windows cmd.exe interpreter on infected hosts

T1204.002Malicious FileEvidence1
TacticExecution

PhantomCore emails PhantomRAT and PhantomRShell as attachments that recipients open and execute on target systems

Stealth

3 techniques
T1027.002Software PackingEvidence1
TacticStealth

PhantomCore uses UPX (the Ultimate Packer for Executables) to pack PhantomRAT, PhantomRShell, and lure documents disguised as archives

T1497.001System ChecksEvidence1

PhantomRAT checks for virtualization and analysis tools on the infected host by reading the Windows registry keys DriverDesc and SYSTEM\ControlSet001\Services\Disk and looking for the string "vmware"

T1622Debugger EvasionEvidence1

PhantomRAT checks for a debugger on the infected host by calling the WinAPI function IsDebuggerPresent()

Discovery

2 techniques
T1497.001System ChecksEvidence1

PhantomRAT checks for virtualization and analysis tools on the infected host by reading the Windows registry keys DriverDesc and SYSTEM\ControlSet001\Services\Disk and looking for the string "vmware"

T1622Debugger EvasionEvidence1

PhantomRAT checks for a debugger on the infected host by calling the WinAPI function IsDebuggerPresent()

T1219Remote Access ToolsEvidence1

PhantomCore uses MeshAgent along with its in-house RAT utilities PhantomRAT and PhantomRShell

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.