Loading malware…
Black RAT is a Go-based remote access backdoor associated with the North Korea-linked Andariel threat group, a subordinate or closely aligned element of Lazarus. It has been observed in 2023 intrusion activity targeting South Korean organizations and appears to be part of a broader Andariel malware ecosystem that includes TigerRAT, NukeSped, Goat RAT, DurianBeacon, and related tooling.
Black RAT is described as a backdoor or RAT that supports remote command execution, file download, and screenshot capture. Its implementation and function naming have been noted as consistent with previously known Black RAT samples, indicating continued development and reuse by the same operator set. The malware reflects Andariel’s broader preference for Go-based tooling in recent campaigns.
Observed delivery in Andariel operations involving Black RAT has included compromise of vulnerable MS-SQL servers and supply-chain intrusion through South Korean asset management software. In the same operational context, attackers also used script-based download and execution mechanisms and established persistence through scheduled tasks, while pairing custom malware with credential-harvesting and privilege-escalation utilities. Victimology associated with these campaigns includes South Korean telecommunications and semiconductor organizations, consistent with Andariel’s longstanding focus on strategic sectors.
Black RAT should be understood as one component of a larger espionage-oriented intrusion set used by Andariel to maintain access, execute commands on compromised hosts, and support follow-on collection and operator control.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Over the last 15 years, the group has developed RATs, including the following... ▪ Black RAT
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Black RAT은 Go 언어로 개발된 백도어 악성코드로서 2023년에 Andariel 그룹의 공격 사례에서 최초로 확인되었다.
Black RAT은 Go 언어로 개발된 백도어 악성코드로서 2023년에 Andariel 그룹의 공격 사례에서 최초로 확인되었다.
Over the last 15 years, the group has developed RATs, including the following... ▪ Black RAT
7 distinct techniques documented for this family, organized by ATT&CK tactic.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan reportedly delivered by the North Korea-linked Andariel group via compromised MS-SQL servers and supply chain attacks involving South Korean asset management software.
Go-based backdoor malware associated with Andariel. The sample in this campaign lacked source-code metadata but was identified by function names closely matching previously known Black RAT samples.
Andariel이 개발한 것으로 언급된 Go 기반 RAT 계열 악성코드.
A Go-based RAT/backdoor that extends beyond simple shell access to support command execution, file download, and screenshot capture.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.