MarkiRAT

Executive Summary

MarkiRAT is a Visual Studio–compiled Windows RAT used by Ferocious Kitten since 2015. It grants attackers full remote control, including command execution, keylogging, screenshot capture, and credential dumping. The malware can persist on infected hosts, facilitating ongoing data exfiltration and lateral movement across networks.

MarkiRAT is a remote access trojan (RAT) that has been observed in the wild as early as 2015 and continues to be employed by the threat actor known as Ferocious Kitten. Compiled with Microsoft Visual Studio, the binary exhibits characteristics of custom-built Windows executables, enabling stealthy persistence through standard registry run keys or scheduled tasks. Once executed on a target system, MarkiRAT establishes a covert channel back to its command-and-control (C2) server, typically over HTTP/HTTPS or raw TCP. The attacker can then issue remote commands that allow full control of the victim’s machine: enumerating processes and services, capturing screenshots, recording keystrokes, exfiltrating files, and injecting malicious code into legitimate applications. The trojan also supports credential dumping from memory (e.g., LSASS process) and can exploit known Windows APIs to avoid detection by antivirus solutions. Its modular design enables the attacker to load additional payloads or modify its behavior dynamically based on network traffic or host characteristics, making it a flexible component of the larger Ferocious Kitten toolkit. Impact-wise, MarkiRAT primarily serves as a backdoor that opens the door for further lateral movement, data exfiltration, and persistence within enterprise environments. Organizations affected by this RAT can experience significant loss of confidential data, compromised system integrity, and increased risk of insider threats if the trojan gains access to privileged accounts.

Key Capabilities

• Establishes covert C2 channel via HTTP/HTTPS or raw TCP
• Permanently persists using registry run keys or scheduled tasks
• Executes remote commands for full system control
• Captures screenshots and logs keystrokes
• Drops additional payloads or modules
• Exfiltrates files or credentials from victim machine
• Performs process injection to evade detection

ATT&CK Techniques

Recommended Actions

• Deploy host-based intrusion detection systems capable of detecting unusual outbound connections on uncommon ports
• Implement strict application whitelisting for executables signed with trusted certificates
• Use endpoint detection and response (EDR) solutions that flag keylogging, screen capture, and credential dumping activity
• Conduct regular vulnerability scanning to mitigate known exploitation vectors used by RATs
• Educate users about the risk of downloading or executing suspicious binaries from unverified sources

Suggested Tags