DRAT V2: Updated DRAT Emerges in Arsenal
TAG-140, a threat actor group overlapping with SideCopy, has deployed an updated version of their DRAT remote access trojan, dubbed DRAT V2. This new variant, developed in Delphi, introduces enhanced command and control capabilities, including arbitrary shell command execution and improved C2 obfuscation techniques. The malware was distributed through a ClickFix-style social engineering attack, using a cloned Indian Ministry of Defence press portal. DRAT V2 demonstrates TAG-140's ongoing refinement of their tooling and their continued focus on Indian government and defense targets.
Pulse ID: 68599b9609a7c9c2dd3baefa
Pulse Link: https://otx.alienvault.com/pulse/68599b9609a7c9c2dd3baefa
Pulse Author: AlienVault
Created: 2025-06-23 18:23:18
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
