Loading malware…
CetaRAT is a C#-based remote access trojan associated with the SideCopy espionage cluster. It has been described as one of the group’s staple custom malware families and has appeared alongside other SideCopy tooling such as ReverseRAT, MargulasRAT, ActionRAT, DetaRAT, AllaKore RAT, and modular C# plugins. SideCopy operations using this malware family have primarily targeted government and defense-related personnel, especially in India, with broader victim interest also noted in Pakistan.
SideCopy intrusion chains commonly rely on spearphishing lures themed around military, government, or geopolitical subjects. Document-themed decoys, compressed attachments, malicious shortcut files, and multi-stage HTA and loader-DLL execution chains have been used to deliver the group’s RAT payloads, and CetaRAT is identified as one of the custom implants delivered through this tradecraft. The actor has also used honeytrap-style lures in some campaigns.
As a remote access trojan, CetaRAT is part of a broader SideCopy post-compromise ecosystem that supports persistent access and modular follow-on activity. SideCopy’s malware sets and plugins have been used for file enumeration, credential theft including browser password theft, and keylogging, indicating that CetaRAT operates within an espionage-oriented framework focused on surveillance and collection from compromised Windows hosts. The family reflects SideCopy’s continuing evolution of bespoke RAT tooling since at least 2019.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The report disclosed that the group used various attack weapons, including CetaRAT, ReverseRAT, MargulasRAT, AllakoreRAT, and several C# plugins.
1 distinct technique documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan listed as part of the SideCopy group's arsenal.
CetaRAT is referenced as a named RAT associated with an APT-themed campaign targeting government agencies.
文中将其列为SideCopy APT组织披露过的攻击武器之一，未提供进一步功能细节。
A C#-based remote access trojan used by SideCopy, delivered via malicious LNK files and documents through multi-stage infection chains (HTAs and loader DLLs).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.