Loading malware…
SparkRAT is an open-source, Go-based remote access trojan used as a cross-platform backdoor on Windows, Linux, and macOS. It has been observed in both opportunistic and targeted intrusions, including exploitation of internet-facing enterprise software, supply-chain-style compromises involving trojanized installers, and campaigns associated with Chinese-speaking operators. Reported use includes the DragonSpark intrusion cluster, compromises involving vulnerable TeamCity and BeyondTrust systems, activity linked to Houken/UNC5174 tradecraft, and malware delivery through compromised VPN software and malicious Windows shortcut-based infection chains targeting organizations in Ukraine.
SparkRAT provides full remote administration capabilities, including command execution, file upload and download, process management, system fingerprinting, screenshot capture, and collection of host information. Public reporting also describes support for encrypted command-and-control communications, including WebSocket-based communications, and an automatic upgrade mechanism in some versions. Operators have used distinct per-target builds, and both x86 and x64 Windows variants have been observed.
In observed attack chains, SparkRAT has commonly served as a post-compromise backdoor rather than an initial access tool. Delivery has followed exploitation of public-facing vulnerabilities, malicious installers that also execute legitimate software to reduce suspicion, and downloader or dropper stages that unpack and launch the RAT. Persistence has been established through mechanisms such as scheduled tasks and startup execution. SparkRAT has also been deployed alongside other offensive tooling and malware families including Cobalt Strike, Sliver, web shells, tunneling tools, ransomware, cryptominers, and credential-focused tooling, indicating its role as a flexible access and control component in broader intrusion operations.
Although SparkRAT is publicly available and used by multiple unrelated actors, several campaigns involving it show overlap with Chinese-language tooling ecosystems and Chinese-speaking operators. Its open-source nature and cross-platform support have made it attractive for reuse across espionage, initial-access, and financially motivated operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Microsoft created a security patch for Windows systems to fix the vulnerability, giving it the CVE identifier CVE-2024-43451. The security patch was published on November 12th, 2024. | The other files detected exploiting the new vulnerability followed a similar attack scenario that ended with the installation of Redline Stealer malware. The similarity has two possible explanations: 1. One attacker using different types of malware (the initial file installs SparkRAT malware).
APT29 (Cozy Bear) exploited CVE-2024-27198 in real-world campaigns.
The vulnerability, tracked as CVE-2026-1731, is an operating system command injection flaw that also impacts some older versions of BeyondTrust Privileged Remote Access. The flaw allows an attacker to execute arbitrary commands on a server without the need for credentials or any user interaction. | A critical vulnerability in BeyondTrust Remote Support is facing an increase in threat activity, with hackers deploying SparkRAT and vShell backdoors and using remote management tools to conduct reconnaissance...
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The other files detected exploiting the new vulnerability followed a similar attack scenario that ended with the installation of Redline Stealer malware. The similarity has two possible explanations: 1. One attacker using different types of malware (the initial file installs SparkRAT malware).
The following public tools were observed on the victims’ network... SparkRAT.
Sandbox family search for family:sparkrat . Returned a per-victim SparkRAT sibling submitted independently to the sandbox. Its ldflags COMMIT differs from the case sample. Confirms the operator uses per-target SparkRAT builds.
...Leslieloader that downloads a backdoor dubbed SparkRAT. The Go variants are compliant with Windows, Linux and OSX. They support file upload and download, system fingerprinting and direct command-line interaction with infected hosts.
"...including CurlBack, SparkRAT, AresRAT, Xeno RAT, AllaKore, and ReverseRAT."
The attacks are characterized by the use of the little known open source SparkRAT and malware that attempts to evade detection through Golang source code interpretation.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
A critical vulnerability in BeyondTrust Remote Support is facing an increase in threat activity ... Multiple BeyondTrust Remote Support users have been confirmed targets ... The flaw allows an attacker to execute arbitrary commands on a server without the need for credentials or any user interaction.
it seems that the threat actor attacked the development company and distributed installers with malware strains
CERT-UA shared technical information with ClearSky regarding the email sent to the target to launch the attack chain. The lure email message is sent from a Ukrainian government server. The message body includes a demand to renew the academic certificate, as the current certificate is allegedly about to expire.
Furthermore, the malware is registered in the task scheduler to ensure it will be executed even after system reboots.
Creating scheduled task Wave360 Sync Technologies Co\SyncWave360[.]js to establish persistence.
It provides features to control the infected system such as executing commands
This version supports 26 commands that implement a wide range of functionalities: Command execution: including execution of arbitrary Windows system and PowerShell commands.
The vulnerability, tracked as CVE-2026-1731, is an operating system command injection flaw ... The flaw allows an attacker to execute arbitrary commands on a server without the need for credentials or any user interaction.
When examining the URL file, ClearSky’s team exposed a new vulnerability, unrelated to the two vulnerabilities mentioned above: Right clicking the file establishes a connection to an external server.
L'exploit permet à des acteurs malveillants de prendre le contrôle d'un système par un simple clic droit sur un fichier malveillant.
The vulnerability is exploited by generating a URL file that can be activated using the following non-standard actions: 1. A single right-click (in all versions of Windows). 2. Deleting the file by using the delete button (only in Windows 10/11). 3. Dragging the file to another folder.
Then a file named Learn[.]cmd is dropped and executed. The CMD file includes commands encoded by adding garbage strings and using several variables that, when put together, create the commands.
File and process manipulation: including process termination as well as file upload, download, and deletion.
The commands carried out by file Learn[.]cmd: • Tasklist[.]exe – listing all tasks running on the system. • findstr /I avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe – checking for installed AV engines. • findstr /I "wrsa.exe opssvc.exe" – checking for additional security components.
La faille de sécurité « CVE-2024-43451 » est une vulnérabilité de divulgation de hash NTLM par usurpation d'identité, qui peut être exploitée pour voler le hash NTLMv2 de l'utilisateur connecté en le forçant à se connecter à un serveur distant contrôlé par un attaquant.
SparkRAT provides basic features commonly found in RAT malware, such as executing commands, stealing information, and controlling processes and files.
Information theft: including exfiltration of platform information (CPU, network, memory, disk, and system uptime information)
SparkRAT provides basic features commonly found in RAT malware, such as executing commands, stealing information, and controlling processes and files.
The commands carried out by file Learn[.]cmd: • Tasklist[.]exe – listing all tasks running on the system. • findstr /I avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe – checking for installed AV engines. • findstr /I "wrsa.exe opssvc.exe" – checking for additional security components.
The malicious installer connects to the C&C server and downloads encrypted configuration data.
SparkRAT uses the WebSocket protocol to communicate with the C2 server and features an upgrade system.
When installed on a user’s system, it can perform a variety of malicious behaviors, such as executing commands remotely, controlling files and processes, downloading additional payloads
Microsoft researchers also identified a sample that can run on Windows based on a cross-platform (Linux, Windows, macOS) open-source remote administration tool (RAT) with various features such as managing processes, file operations, screenshotting, and running commands.
40 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan/backdoor deployed following exploitation of TeamCity vulnerabilities.
Remote access trojan observed in exploitation activity targeting a BeyondTrust critical vulnerability (CVE-2026-1731).
Remote access trojan observed in exploitation activity against BeyondTrust (CVE-2026-1731) per the content.
Remote access trojan used to provide interactive remote control of compromised hosts as part of post-exploitation activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.