Coldroot RAT

The Coldroot RAT is a Remote Access Trojan that provides an attacker with capabilities for controlling the computer and collecting information, especially, any keyboard-typed content. This threat is compatible with multiple OSes, including Mac, Windows, and Linux machines, and its source code is in the wild for any criminal's misuse. Users can update their software, monitor their PCs for unexpected warning prompts, and use anti-malware products for eliminating all Coldroot RAT infections.

A Chilling Trojan for All OSes

Most Trojans specialize in particular environments, from smartphones, like the BianLian banking Trojan, to Windows desktops, such as most variants of Crysis Ransomware's Ransomware-as-a-Service business. Sometimes, though, a Trojan has the work put into it for achieving cross-compatibility or being available in different builds for various OSes, such as 2018's Coldroot RAT. This Remote Access Trojan is most well-analyzed in its macOS variant but can compromise Linux and Windows systems, too.

The Coldroot RAT grants threat actors control over the PC by processing commands that it receives from a C&C server, which it connects to automatically. It also includes default support for keylogging activities that record typed content (such as passwords from logging into a website). Other attacks that malware experts recommend being aware of include:

• Executing or terminating programs' processes.
• Downloading or uploading files.
• Fetching file and folder information.
• Monitoring active windows.

Like any Remote Access Trojan, the Coldroot RAT also delivers remote administrative desktop capabilities. Through this feature, an attacker can install other Trojans, destroy or collect data, or cause additional, negative impact against the PC.

Going Straight to the Root of a Security Failure

Outdated but functional code for the Coldroot RAT is available in the wild for any threat actors who prefer using it over a premium RAT, such as the updated version of the same Trojan. Previous cases of Coldroot RAT attacks utilize exploits such as fake documents and audio drivers for hiding the Trojan's components, including misleading icons and filenames. However, these social engineering tactics require the user's (albeit misinformed) consent before proceeding.

Some versions of the Coldroot RAT include warning signs of their installation exploits, such as requiring the user's login for privileged execution authorization. Afterward, however, the Coldroot RAT achieves total system persistence and compromise the root of the PC. Old versions of operating systems, such as OS X, may be more vulnerable to these exploits and not provide the pop-up prompt.

Malware experts recommend that victims restart the computer through a recovery USB or other, root-circumventing startup routine. After achieving this minimum environmental safety, most anti-malware products should uninstall the Coldroot RAT adequately.

The Coldroot RAT is another spyware and backdoor threat that needs help from the person it's attacking before gaining any valuable intelligence. Mindlessly agreeing to any request a 'driver' asks of you is just one of many ways for compromising your machine, regardless of the operating system.