Loading malware…
Lilith RAT is an open-source remote access trojan written in C++ and publicly available on GitHub. It provides core remote administration capabilities including remote command execution, persistence, and self-deletion, enabling operators to control compromised Windows systems after infection. Reporting also indicates that threat actors have cloned or customized Lilith RAT code and incorporated its features into bespoke backdoors, making it both a directly used implant and a source of functionality for derivative malware.
Lilith RAT has been associated with North Korea-linked activity, particularly campaigns attributed to Andariel, a subordinate element of Lazarus/Reconnaissance General Bureau infrastructure, as well as separate reporting that TICK studied and implemented Lilith RAT features in a customized backdoor. In Andariel operations, Lilith RAT has appeared alongside other implants such as TigerRAT, NukeSped, and Black RAT in intrusions targeting South Korean organizations, including telecommunications and semiconductor-related victims, and in broader espionage activity against defense, aerospace, nuclear, engineering, medical, and energy sectors.
Observed delivery contexts include spearphishing with malicious attachments, compromise of vulnerable MS-SQL servers, and supply-chain abuse involving South Korean asset management software. Government reporting also identifies Lilith RAT among open-source or dual-use tools used or customized by Andariel. In at least one reported Andariel-linked sample, many strings were encrypted, likely as a file-based detection evasion measure, while portions of the public-source code remained recognizable.
Lilith RAT should be understood as a dual-use, commodity-style RAT whose operational significance comes from both direct deployment and adaptation by state-linked operators. Its use in espionage-oriented campaigns reflects its suitability for persistent remote control and post-compromise access on Windows hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ Lilith RAT
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For instance, they cloned Lilith RAT from GitHub, studied and implemented its features into their customized backdoor under continued development.
Lilith RAT은 깃허브에 공개된 오픈 소스 RAT 악성코드이다. C++ 언어로 개발되었으며 원격 명령 실행, 지속성 유지, 자가 삭제 등 감염 시스템을 제어할 수 있는 다양한 기능들을 제공한다.
Lilith RAT은 깃허브에 공개된 오픈 소스 RAT 악성코드이다. C++ 언어로 개발되었으며 원격 명령 실행, 지속성 유지, 자가 삭제 등 감염 시스템을 제어할 수 있는 다양한 기능들을 제공한다.
The authoring agencies have identified the following open source and dual-use tools as used and/or customized by the actors: ▪ Lilith RAT
4 distinct techniques documented for this family, organized by ATT&CK tactic.
この LilimRAT は OSS の RATツールである Lilith RAT をカスタマイズしたもので、WDAGUtilityAccount というユーザフォルダの存在を確認する処理が実装されており、このユーザフォルダがないと起動されないようになっていました。... Windows サンドボックス内では、デフォルトユーザ名として WDAGUtilityAccount が使われることから、今回解析対象にしたLilimRAT は Windows サンドボックス内でのみ動作することを想定して開発されたと考えられます。
この LilimRAT は OSS の RATツールである Lilith RAT をカスタマイズしたもので、WDAGUtilityAccount というユーザフォルダの存在を確認する処理が実装されており、このユーザフォルダがないと起動されないようになっていました。... Windows サンドボックス内では、デフォルトユーザ名として WDAGUtilityAccount が使われることから、今回解析対象にしたLilimRAT は Windows サンドボックス内でのみ動作することを想定して開発されたと考えられます。
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan referenced as a payload delivered via malicious attachments to take over victim machines.
A remote access trojan reportedly delivered by the North Korea-linked Andariel group via compromised MS-SQL servers and supply chain attacks involving South Korean asset management software.
Open-source C++ RAT used in this campaign. It provides remote command execution, persistence, self-deletion, and other host-control capabilities. The actor's sample encrypted many embedded strings, likely to evade file-based detection.
A publicly available RAT whose features were studied and incorporated into TICK’s customized backdoor development.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.