OmniRAT

OmniRAT is a Remote Access Tool or RAT that lets users administrate or control a PC or other device, such as phone, remotely. Although its official business is no longer active, threat actors may abuse OmniRAT for threatening goals like collecting data or installing other threats. Users should protect all relevant systems with compatible anti-malware products to remove OmniRAT in non-consensual installation scenarios.

A Little Remote Administration from Criminals for One and All

RAT developers who aren't employed by state-sponsored APTs tend to walk a fine line between marketing their software as broadly as possible and avoiding negative attention from law enforcement. The story of OmniRAT shows just how delicate that balance can be and what happens when a developer falls to one side or the other. On the other hand, for all its pretensions, most users can treat OmniRAT as no different from a backdoor Trojan or a threat like DarkComet.

OmniRAT includes ports compatible with Windows, macOS, Linux, and Android, which makes it far more portable than the average RAT. The software contains comprehensive management features for the system's accounts, Web browsers, clipboard (storage for copied and pasted information), and, in the case of Android phones, applications, and widgets. It also can initiate phone calls or text messages and execute general-purpose system commands.

Supposedly, the OmniRAT's developer intended it for legal uses, such as parental monitoring, as per its website's marketing. The behavior of the still-unidentified developer, however, throws this into question. OmniRAT is highly-exploitable as a tool for monitoring devices, collecting information, or installing more unwanted software. It's little surprise that some promotional posts for the Remote Access Tool appeared on hacking-oriented dark Web forums or that there are cases of attackers using OmniRAT for blatantly-illegal purposes.

Straying from the Lures of All-Purpose Monitoring Tools

Some years after its introduction to the Web, OmniRAT's business was shuttered, alongside a dramatic German police raid of its developer's digital assets. Unfortunately, OmniRAT's design includes no Command & Control dependencies that keep attackers who still have the program from leveraging it in independent campaigns. Because anyone could 'rent' OmniRAT at a low price, deployment and distribution exploits can occupy a diverse range of possibilities.

Concerning Android users, malware experts recommend not installing applications outside of official, curated storefronts like Google's. Some campaigns may also use phishing tricks involving obfuscated text message links or typo-squatted websites to trick victims into infecting their devices. Readers should remember that OmniRAT also is a possible threat to home computers or workplace networks and runs on most operating systems.

Without substantial modification, OmniRAT should trigger flags from updated cyber-security products' threat heuristics. Compatible security software for the appropriate system should delete OmniRAT. Despite that, users should keep in mind the possibility of collected information during the infection's lifespan.

OmniRAT is a good morality tale of how business pressures can lead talented programmers towards a path on an inevitable confrontation with law enforcement. Whether it's a Multimedia Messaging Service Trojan or a phony application, hiding an invasive program like OmniRAT is no different from concealing needles in candy.