Bozok RAT

The Bozok RAT is a Remote Access Trojan that gives threat actors various controls over the infected system, including altering the Registry settings, closing or opening programs and downloading or uploading files. This threat is freely available to interested hackers and uses a simple interface that requires no programming experience. Appropriate defensive steps against its attacks include keeping anti-malware services for deleting a Bozok RAT quickly and paying attention to probable infection paths, such as e-mail attachments.

A RAT Scurrying Around for Free

While close-kept secrets like Stuxnet may inspire awe at their unique solutions to various cyber-warfare questions, even freeware Trojans like the Bozok RAT are more than a little threatening to most PC users. The proof of the Bozok RAT's quality, most obviously, lies in how even seasoned threat actors like the admin@338 group will make room for it in their arsenal of network-infiltrating attacks. In some ways, the Bozok RAT is worse, since, as free software, its deployment can race out of control, as long as any criminals have an interest in taking advantage of it.

The Bozok RAT's author, 'Slayer616,' is regularly maintaining and updating the program, which provides an extremely user-friendly interface for letting attackers control infected systems. His support goes so far as adding various languages, including Arabic, English, French, and Polish, all of which help with making the menu-based, 'point and click' style interface readily usable. However, unlike legitimate Remote Access Tools, the Bozok RAT bakes in various features with deliberate attack and espionage implications.

The Bozok RAT accepts various commands for implementing Remote Shell-based attacks and is modularly extensible. Its default functions, without further downloads, include launching or closing processes, downloading files from a C&C to the system or uploading files to the C&C, changing the Windows Registry settings, and collecting password credentials. Optional extensions to the Bozok RAT can give it improved access to the webcam and keylogger functionality for recording anything that the user types.

Keeping Ahead of Even the Most Affordable of Trojans

The menu-based admin panel of the Bozok RAT grants threat actors the attack capabilities of, theoretically, experienced hackers without any of the difficulties of learning to code or creating a unique Trojan. However, the RAT requires delivering, still, and old campaigns involving it tend to use e-mail lures as favored methods for compromising a target. Updating software for removing vulnerabilities, scanning your downloads (especially attached documents), and double-checking the authenticity of any download sources for any signs of attacks, such as the wrong Web address, are always-relevant defenses.

Since its updates have yet to stop coming in, the Bozok RAT may improve its feature set beyond those functions that this article lays out for readers. Those who suspect infections should turn off any network connections, for stopping an attacker from using any more commands to the Bozok RAT and run an appropriately thorough scan of both files and memory with a trusted anti-malware product. Malware experts find no unusual features that would prevent the removal of a Bozok RAT through appropriate security tools, although, as always, other threats that it downloads could interfere.

That the Bozok RAT is so amenable to hostile uses doesn't make it harmless, even compared to more sophisticated toolkits. In fact, with their campaigns being intensely variable, freeware versions of Trojans may be the worst thing that the average computer or smartphone owner could ever see.