A newly identified remote access trojan (RAT) dubbed ResolverRAT has emerged as a significant threat to global enterprises, leveraging advanced in-memory execution and multi-layered evasion techniques to bypass traditional security measures. Morphisec said in a report shared with Cyber Security News that the most recent attack wave was observed on March 10, 2025, underscoring its active deployment in sophisticated cyberespionage campaigns. The attack targeting healthcare and pharmaceutical organizations, this malware family employs runtime resource resolution, encrypted payloads, and certificate-pinned command-and-control (C2) infrastructure to maintain stealth. ResolverRAT’s loader uses AES-256 encryption with keys stored as obfuscated integers, decrypted at runtime via the .NET System.Security.Cryptography namespace. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. This technique evades security tools monitoring traditional injection vectors by bypassing Win32 API calls and file system operations. Morphisec advocates for Automated Moving Target Defense (AMTD), which preemptively disrupts attack chains by randomizing memory layouts and blocking unauthorized code execution. As threat actors refine their evasion capabilities, organizations must adopt proactive defense mechanisms capable of neutralizing advanced persistent threats before they establish footholds. The emergence of ResolverRAT highlights the escalating sophistication of cyber threats leveraging runtime dynamics and cryptographic obfuscation. Continuous monitoring of phishing trends and investment in behavioral analysis technologies will be critical to mitigating risks posed by such stealthy malware families. Registry keys and file paths are obfuscated via XOR operations, and the malware maintains a fallback hierarchy to ensure persistence even if some methods fail. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Examples include Hindi-language lures referencing “जाँच प्रक्रिया में दर्ज किए गए दस्तावेज़” (“Documents recorded during the investigation process”) and Italian emails titled “Documento per confermare la violazione del copyright”.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Apr 2025 16:55:19 +0000