There is a threat group known as "Anonymous Arabic" that released Silver RAT, a remote access Trojan (RAT) that can bypass security software and launch hidden programs quietly on the computer system. Cyfirma claims that the developers maintain a sophisticated and active presence on multiple hacker forums and social media platforms, as outlined by the cybersecurity company.
Besides operating a Telegram channel offering leaked databases, carding activities, and more, these actors, who are thought to be Syrian in origin, are also linked to the development of another RAT which is called S500 RAT.
An anonymous group known as Anonymous Arabic has developed a remote access trojan (RAT) called Silver RAT, which is designed for bypassing security software, launching hidden apps, and installing them in the background.
As reported last week by cybersecurity firm Cyfirma, "the developer is active on multiple hacker forums and social media platforms, illustrating a sophisticated and active presence on those platforms," the report said.
In addition, the actors, who are reportedly of Syrian origin and are linked to developing another RAT known as the S500 RAT, are also running a Telegram channel where they can distribute cracked RATs, leaked databases, carding activities, and Facebook bots (formerly Twitter bots) for sale.
These activities are also part of the distribution of cracked RATs, leaked databases, and carding activities.
The threat analysis published on Jan. 3 reveals that SilverRAT v1 is currently only available to users with Windows operating systems, however, it has destructive capabilities, such as the ability to destroy system restore points, as well as the ability to build malware for keylogging and ransomware attacks.
Researchers from Singapore-based Cyfirma stated this in their analysis.
The Silver RAT v1.0 was observed in the wild in November 2023. It was discovered that the SilverRAT creators had also developed another product called the S500 RAT. Although SilverRAT is currently a Windows-based product, recent announcements have indicated that the developers are planning to release a new version that will be able to generate both Windows and Android payloads in the future.
In addition to the destructive features included in Silver RAT v1.0, there are functions to destroy system restore points as well as a keylogger, UAC bypass, data encryption and data encryption.
This Silver RAT was developed by Noradlb1, a hacker that has a well-earned reputation on prominent hacker forums including XSS, Darkforum, TurkHackTeam, and numerous others with an unquestionably respected reputation.
First appearing on their Telegram channel, the RAT has since appeared on forums like TurkHackTeam and 1877. This project is by no means new.
In October of 2023, Silver RAT was cracked and leaked on Telegram, and users are now sharing cracked versions of Silver RAT v1.0 on Telegram and GitHub to users who cannot afford RATs since it was not as effective as other well-known RATs like Xworm according to user conversations (however, there has been evidence that this may be less effective than other RATs).
Following the leak of the latest version of Silver RAT, which is free to use for malicious purposes, the developer of Silver RAT intends to release new versions of the RAT to combat the problem. It appears that the developer, known as Anonymous Arabic, is strongly supportive of Palestine, as their Telegram posts indicate.
In addition, members of this group are active on several platforms, such as social media sites, development platforms, underground forums, and Clearnet websites. They are likely involved in the dissemination of malware via these platforms. For organizations to respond to this potential threat, they must develop stronger defence mechanisms to adequately guard against it.
Recommendations for Management
Developing and communicating an incident response plan that outlines steps that can be taken if a device is compromised is an important part of preparing for an incident. An essential part of this strategy would be the isolation of the device, the notification of relevant parties, and the mitigation of the situation.
Support for Users: provide users with a clear route to report suspicious activity, unusual behaviour, or potential security incidents by providing them with a clear channel to do so. Be sure to explain to them the importance of reporting such incidents as soon as possible.
Regularly backing up the device's data to a secure location is an important step in keeping the device secure. A data loss incident caused by a security breach can be mitigated to the extent that the impact will be reduced.
