BlackWorm RAT

The BlackWorm RAT is a Remote Access Trojan used for surveilling and controlling PCs remotely. Its attacks can block crucial programs, run videos for distracting victims, block user input, and install other threats onto the system. Have anti-malware products delete a BlackWorm RAT as soon as possible after its detection and change any credentials that attackers could have used it to collect.

Old Political Tensions Still can Be Computer Problems

A possible branch of the Syrian Electronic Army (or SEA), the Syrian Malware Team, is well-known over the years for deploying a Remote Access Trojan for their intelligence operations. Although current activity by this threat actor is highly-limited, the BlackWorm RAT is available in multiple editions through different builders or construction toolkits. Consequently, any criminal could pick up the BlackWorm RAT, deploy it, and use it for taking over a Windows system or its local network.

The most notable releases of the BlackWorm RAT include 0.3 and the so-called 'Black Edition.' With the former, the only, configurable option is the IP address for the criminal's server for issuing commands and transferring information back and forth. The Black Edition of the BlackWorm RAT, however, has far more options. Its most memorable ones include UAC bypasses, lateral network traversal, USB-spreading, anti-sandboxing, and auto-terminating various Windows tools selectively.

Although malware experts rank this version of the BlackWorm RAT as being, by far, the most threatening of the two, even the primitive version of the Remote Access Trojan is a high-level threat. All variants of the BlackWorm RAT can download and run files, reboot the system, close Windows processes, block mouse or keyboard input, and display flash movies as distractions. Despite its political history, the BlackWorm RAT's kit is suitable for other threat actors besides a pro-Syrian regime 'hacktivist' group.

Pulling the Worm Out of Your Network

SEA's operations are no longer at the forefront of the threat landscape, and the last, notable event concerning this threat actor is the 2018 arrest of some of its members. However, the BlackWorm RAT is buildable through its kit being in the hands of any, random criminal, and includes features partially authored by the same programmer who's responsible for Backdoor.Ratenjay (NJRAT) and H-Worm. Users should maintain appropriate security precautions, such as examining e-mails for a possible phishing attack, before interacting with attachments, downloaded files, etc.

Always isolate compromised machines from the rest of their networks and avoid sharing removable devices that the BlackWorm RAT might compromise. Although this Trojan's data-exfiltrating features are somewhat limited, a BlackWorm RAT attack can install other threats, such as file-locking Trojans, keylogging spyware, and similar programs. Windows users should keep anti-malware products on-hand for uninstalling the BlackWorm RAT or catching its installation exploits before they do any damage.

The ongoing unrest in Syrian makes predicting the actions of any resident hackers into a guessing game for the cyber-security industry. What the BlackWorm RAT serves as a reminder of is that anyone living in a war-torn region or a peaceful one can pick up a Remote Access Trojan and cause quite a lot of damage without much effort.