DslogdRAT

DslogdRAT is a remote access malware observed in intrusions involving exploitation of Ivanti Connect Secure appliances, particularly CVE-2025-0282. It was reported in attacks against organizations in Japan beginning in late 2024, where exploitation of the appliance vulnerability enabled deployment of a Perl web shell that subsequently delivered DslogdRAT. The malware establishes a socket-based connection to an external controller, transmits basic host information, and supports remote command execution, file upload and download, and proxying of network traffic through the compromised system. These capabilities make it suitable for hands-on post-compromise operations and follow-on intrusion activity.

DslogdRAT has been discussed alongside other malware used in Ivanti Connect Secure exploitation campaigns, including SPAWNCHIMERA and other SPAWN-related tooling, but available reporting does not conclusively tie DslogdRAT to the same campaign or operator. The broader activity has been associated with exploitation of edge infrastructure and subsequent post-exploitation actions against private-sector and government targets. High-confidence reporting supports DslogdRAT as a post-exploitation remote access tool used after successful compromise of Ivanti Connect Secure environments.