P8RAT

Executive Summary

P8RAT is a memory-resident tool used by menuPass (APT10) to download and run arbitrary payloads in Windows environments. Its fileless operation reduces disk I/O, making it difficult for traditional AV scanners to detect. Security teams should monitor anomalous PowerShell activity and network traffic toward known C&C endpoints.

P8RAT is a sophisticated fileless threat that has been employed by the menuPass group—believed to be linked with APT10—for several years, first detected in 2020 according to Securelist reports. The malware operates entirely from memory, avoiding persistent artifacts on disk. Once it infiltrates a Windows system, P8RAT queries its command-and-control server for additional payloads and then downloads them into RAM or directly executes them via PowerShell or WMI scripts, ensuring that no dropped binaries trigger traditional signature-based defenses. Operationally, the actor leverages legitimate Microsoft tooling (e.g., PowerShell, rundll32, scheduled tasks) to establish persistence and to orchestrate lateral movement. P8RAT also employs encryption and obfuscation techniques to hide its network activity and payload contents from detection tools. While the current data set does not detail specific secondary payloads or target sectors, the fileless nature combined with automated download and execution capability suggests a focus on stealthy persistence, rapid escalation, and potential exfiltration of corporate data. Overall, P8RAT demonstrates how state-sponsored threat actors are evolving beyond dropper-based malware, preferring in‑memory exploitation vectors that reduce footprint and increase the chance of remaining unseen for extended periods.

Key Capabilities

• File‑residential persistence via memory only
• Downloads and executes payloads from an external C&C source without touching disk
• Uses Windows PowerShell or WMI scripts for command execution
• Evades detection through encryption and obfuscation of commands
• Establishes persistence via scheduled tasks or registry run keys

ATT&CK Techniques

Recommended Actions

• Block outbound traffic to known P8RAT C&C IP addresses and domains using your firewall or IPS rules
• Implement PowerShell logging and monitor for suspicious cmdlet usage (e.g., Invoke-Expression, IEX)
• Watch for unexpected creation of scheduled tasks or services that launch from non‑standard paths
• Deploy an EDR solution capable of detecting fileless activity such as memory‐resident code execution
• Apply security baselines to harden Windows registry keys and protect against malicious modifications

Suggested Tags