KazakRAT
KazakRAT is a Windows-based remote access trojan/implant used in a suspected state-affiliated cyber-espionage campaign active since at least August 2022. Researchers described it as a DLL-based RAT delivered via malicious MSI installers, including lures packaged with Kazakhstan- and Afghanistan-themed decoy documents. Observed decoys included a fake letter from the President of the Republic of Kazakhstan and documents themed around Afghan provincial authorities in Khost. The campaign primarily targeted Kazakh entities, including likely government and financial-sector roles, and also targeted Afghan government-related entities.
KazakRAT is described as a simple, unobfuscated RAT with little evasion. It establishes persistence via the Windows Run registry key and executes through rundll32. Command-and-control communications use unencrypted HTTP, with beaconing every five seconds and command retrieval via HTTP POST requests to /as/include.php using an id derived from the C: drive VolumeSerialNumber. Reported capabilities include host profiling, OS and process enumeration, drive and file enumeration, command execution, downloading and executing additional payloads, searching for files, and exfiltrating files over HTTP POST. Documented commands across variants include exec, disks, info, ctd, upload, and variant-specific file exfiltration commands such as dload, download, and dl.
Researchers reported command-and-control infrastructure active as of 20 January 2026 and identified C2 domains including server.fsocmicrsoft[.]com, dns.freiesasien[.]com, dsn.mamurigovaf[.]site, and dns.microbwt[.]team. One sample reportedly connected to dsn.mamurigovaf[.]site while using the Host header dns.microbwt[.]team. Researchers gained control of the expired domain dns.freiesasien[.]com and sinkholed victim traffic, observing Kazakh IP addresses still beaconing. The activity has been assessed as likely linked to a low-maturity, suspected state-affiliated actor. Overlapping infrastructure was also linked to modified XploitSpy Android spyware used by the same group, but no definitive attribution was established.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
During our tracking we identified a Windows-based RAT, delivered as a DLL, that we have coined KazakRAT. KazakRAT allows the threat actor to download and run additional payloads, enumerate and collect host data, and search for and exfiltrate files.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
Notably this sample had a decoy Word document, flReport.doc, that is a fake letter from the President of the Republic of Kazakhstan.
persist using the Run registry key in order to execute the DLL with rundll32
Discovery
4 techniques
Discovery
variants A, C, D sample also leveraged the Win32 API function EnumProcesses enumerate PIDs which are then used to get process names
all variants of KazakRAT will collect OS version information using GetVersionExW
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan family enabling comprehensive remote control and selective post-compromise capability deployment; suspected state-affiliated use targeting Kazakh and Afghan entities in a campaign ongoing since at least August 2022.
Post navigation Previous: Hijacking the Hackers: Researchers Sinkhole “KazakRAT” Espionage Campaign
DLL-based Windows remote access trojan used for espionage. Capabilities include downloading/executing additional payloads, enumerating/collecting host data, searching for and exfiltrating files. Uses simple, unencrypted HTTP beaconing to C2 and appears largely unobfuscated.
Only mentioned in navigation text as part of a separate espionage campaign; no technical details provided in the analyzed content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.