ObliqueRAT

Executive Summary

ObliqueRAT is a Windows Remote Access Trojan used by the Transparent Tribe for stealthy persistence and command execution. The malware mirrors capabilities seen in Crimson and has been operational since at least 2020, enabling attackers to exfiltrate data and extend lateral movement within targeted networks.

ObliqueRAT is a Windows‑based remote access trojan that has been actively leveraged by the cybercrime group Transparent Tribe since at least 2020. The malware functions as a backdoor, enabling attackers to remotely execute commands, transfer files, and potentially capture user input. Its architecture closely resembles that of Crimson, another well‑known RAT, suggesting shared development practices or tooling within the Transparent Tribe ecosystem. Because it is operated by a prolific threat actor, ObliqueRAT is considered part of an ongoing campaign aimed at gathering intelligence and facilitating further malicious activities. Threat intelligence feeds from Palo Alto Networks Talos report that ObliqueRAT has been observed in multiple campaigns dating to March 2021 and May 2021. Analysts note its use for stealthy persistence on compromised Windows hosts, allowing attackers to maintain long‑term access while obfuscating payload delivery through custom protocols and encrypted communications. Overall, the limited available data points to ObliqueRAT being a modular remote control tool capable of lateral movement, data exfiltration, and potentially additional post‑exploitation functionalities typical of advanced RAT families.

Key Capabilities

• Remote command execution via custom C&C protocol
• File upload and download between infected host and attacker
• Screen capturing and keystroke logging (inferred from RAT behavior)
• Persistence mechanisms on Windows platforms
• Encrypted communications to avoid detection

ATT&CK Techniques

Recommended Actions

• Identify and block outbound traffic to known ObliqueRAT C&C domains and IP addresses
• Implement application whitelisting to prevent execution of unknown binaries
• Monitor system logs for signs of remote desktop or PowerShell activity typical of RATs
• Deploy endpoint detection and response solutions capable of detecting keystroke logging and screen capture behaviors
• Apply timely security patches to reduce exploitation surface on Windows systems

Suggested Tags