RUSTRIC

RUSTRIC is a Rust-based implant/RAT associated with SEQRITE-tracked UNG0801 in Operation IconCat, observed targeting Israeli organizations since November 2025. Reporting describes it as an espionage-focused malware used to steal sensitive data. The malware was delivered in a phishing campaign using Hebrew-language lures and spear-phishing emails, including messages impersonating the Israeli HR company L.M. Group, with a malicious Microsoft Word document containing macros that extracts and launches the payload. The campaign spoofed SentinelOne branding and iconography so the implant appeared to be a legitimate security-related binary. RUSTRIC performs reconnaissance and host identification, including gathering basic system information, running commands via Windows Management Instrumentation, and enumerating the presence of 28 antivirus/EDR products, with examples including Quick Heal, CrowdStrike, and Kaspersky. It then establishes command-and-control communications with attacker-controlled servers over HTTPS/port 443. Reported victim sectors include Israeli IT, HR/staffing, software development, and more broadly Israeli organizations. Infrastructure reporting tied the campaign to netvigil.org certificate residue and included IOC examples such as stratioai[.]org and 159[.]198[.]68[.]25. Attribution remains not definitive, but SEQRITE assessed the broader UNG0801 cluster as likely originating from Western Asia.