Microsoft has issued an urgent security advisory regarding a newly discovered malware strain called StilachiRAT, which specifically targets and exfiltrates data from Remote Desktop Protocol (RDP) sessions. Microsoft recommends organizations implement multi-factor authentication for RDP connections, restrict RDP access to trusted networks, keep systems fully patched, and deploy endpoint detection and response solutions capable of identifying API hooking techniques. Organizations with remote workers or administrators who frequently utilize RDP face significant risks from this threat, as compromised sessions can lead to lateral movement within networks, data theft, and potential ransomware deployment. Microsoft Security researchers identified the malware’s distinctive command and control infrastructure, which utilizes a combination of encrypted DNS tunneling and HTTPS callbacks to exfiltrate stolen data. Once executed on a victim’s system, StilachiRAT establishes persistence by creating a scheduled task that runs at system startup and modifying registry keys to ensure it remains undetected by security solutions. Security experts warn that this new threat possesses advanced capabilities to capture credentials, keystrokes, and even hijack ongoing RDP sessions without detection. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Analysis of infected systems revealed that StilachiRAT employs sophisticated anti-analysis techniques, including virtual machine detection and debugger evasion capabilities. The malware’s primary function focuses on intercepting RDP session data by hooking into the Windows Remote Desktop Services API. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. This allows it to capture login credentials, monitor session activities, and even record entire remote sessions for later review by attackers. Security researchers from Bitdefender have uncovered a large-scale ad fraud campaign involving 331 malicious apps on the Google Play Store.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Mar 2025 14:15:17 +0000