SombRAT

Executive Summary

SombRAT is a modular Windows backdoor in C++ that has been used since 2019 as a delivery mechanism for malware such as FIVEHANDS ransomware. It downloads and executes arbitrary payloads from adversary command & control servers, providing attackers with persistent remote access and flexibility to deploy new modules.

SombRAT is a modular remote‑access trojan (RAT) written in native C++ and designed to run on Windows operating systems. First identified in 2019, it has evolved into a flexible code base that allows attackers to load additional modules at runtime through dynamically downloaded components. The malware’s architecture enables the execution of arbitrary binaries or scripts supplied from an adversary command‑and‑control (C2) server, effectively turning any compromised host into an execution engine for subsequent payloads. One of the most notable uses of SombRAT has been as a delivery vehicle for the FIVEHANDS ransomware family. Public reports by BlackBerry CostaRicto (November 2020), FireEye (April 2021) and CISA (May 2021) confirm that threat actors have leveraged SombRAT to fetch, decrypt, and run the FIVEHANDS executable on victim machines, providing a stealthy drop‑in replacement for other delivery mechanisms. In addition to ransomware, the modular backdoor can host diverse payloads ranging from information‑stealing scripts to sophisticated lateral‑movement tools. The trojan typically establishes persistence via registry manipulation or scheduled task creation, although exact vectors vary by variant. It communicates with its C2 infrastructure over encrypted TCP sockets and may attempt domain‑fronting or proxy usage to evade detection. SombRAT’s design also lends itself to obfuscation; the code can be compiled with stripped symbols and anti‑debugging hooks, further limiting analyst visibility.

Key Capabilities

• Modular architecture that loads additional components at runtime
• Downloads and executes arbitrary binaries or scripts from C2
• Establishes persistence via registry edits or scheduled tasks
• Uses encrypted TCP sockets for command communication
• Supports multiple payload families (ransomware, data exfiltration, lateral movement)

ATT&CK Techniques

Recommended Actions

• Deploy application whitelisting to block unauthorized executables
• Implement network segmentation and firewall rules to restrict outbound connections on uncommon ports
• Use endpoint detection platforms to flag suspicious DLL injection or persistence modifications
• Monitor for anomalous outbound traffic to known malicious IPs/domains used by FIVEHANDS
• Conduct regular vulnerability assessments of un‑patched Windows systems

Suggested Tags