Schrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem
summary
Registers expired RAT controller domains and sinkholes them, collecting 153 million connections from 828,137 IPs then filters noise using payload parsing, full protocol handshakes, sandbox-behavior heuristics and session fingerprinting to collapse churned IPs into 3,000 unique infections. Builds a high-fidelity sinkhole called rat wall and an active scanner called brat scan. Shows over 99% of initial connections are scanners or sandboxes and reports long-lived campaign residue across 6,000 reclaimed no‑IP domains.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:32RAT: Remote Access Trojan
- 0:59RAT: Attackers
- 1:52RAT: Basic Operation
- 2:45RAT: Sinkholing
- 3:06RAT: Scanning
- 3:46Naive Sinkholing and Scanning
- 4:22Studying RAT Ecosystem: Data Set
- 6:14RAT-Hole: Initial Handshake Analysis
- 7:43RAT-Hole: Protocol Analysis
- 8:29RAT-Hole: Behavioral Analysis
- 9:29RAT-Hole: Fingerprint Analysis
- 10:43Victim Analysis: Domains and Victims
- 11:39Victim Analysis: Infection Longevity
- 12:36Victim Analysis: Geolocation
- 12:55RAT-SCAN: Measuring the Attackers
- 13:49Who Attacks Who?
related talks
17mRadRAT: An all-in-one toolkit for complex espionage ops
31mHacking People’s Mind: When Threat Actors Master Social Engineering
49mxRAT
47mDetecting and analyzing files-less malware
26mTracking the World's Dumbest Cyber Mercenaries
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
59mCatching Malware En Masse: DNS and IP Style
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group