RDAT

Executive Summary

RDAT is a backdoor linked to the Iranian OilRig threat group that surfaced in 2017, targeting telecommunications organizations. It provides remote command execution, persistence via scheduled tasks or services, and exfiltrates credentials over encrypted HTTPS channels. Security teams should monitor anomalous outbound traffic, block known RDAT indicators, and enforce rigorous endpoint logging.

RDAT is a lightweight Windows backdoor that has been linked to the Iranian threat group OilRig since its initial appearance in late 2017. The malware was first reported by Unit42 in July 2020, when investigators discovered several telecom‑sector targets infected during that period. RDAT’s primary function is to provide adversaries with remote control over compromised machines and to facilitate further infiltration of the victim network. Upon execution on a Windows system, RDAT registers itself as a background service and creates scheduled tasks to ensure persistence across reboots. It opens outbound HTTPS connections to a set of command‑and‑control (C2) servers using a custom binary payload over standard web protocols. The malware then accepts and executes remote commands delivered in this channel, allowing the attacker to perform file operations, run arbitrary PowerShell scripts, and gather system information. One of RDAT’s most concerning capabilities is credential harvesting. By querying the SAM database or intercepting user‑logged‑on credentials, the backdoor can dump password hashes that are later exfiltrated over the encrypted C2 channel. In addition, RDAT performs network reconnaissance to identify adjacent devices and uses legitimate Windows utilities (e.g., WMI, SMB) for lateral movement, thereby avoiding the need for repeated credential theft.

Key Capabilities

• Remote command and control over encrypted HTTP/S
• Persistence through Scheduled Tasks and Windows Services
• Credential harvesting from SAM database and memory
• Network reconnaissance and lateral movement using WMI/SMB
• Data exfiltration of logs and stolen credentials
• Minimal footprint binaries to evade detection

ATT&CK Techniques

Recommended Actions

• Block all known RDAT C2 domains, IPs and TLS fingerprints at the network perimeter
• Enable endpoint detection that flags creation of unknown Scheduled Tasks or services with suspicious names
• Monitor PowerShell and WMI activity for anomalous commands and unauthorized remote execution
• Enforce multi‑factor authentication on privileged accounts and segregate telecom critical servers
• Apply timely patches to Windows components, especially SMB/NFS related CVEs that OilRig often exploits
• Maintain centralized logging of service creations, scheduled tasks, and outbound HTTP/S traffic for forensic analysis

Suggested Tags