DEV Community

Anoymask
Anoymask

Posted on

Hacking Cat: Destructive Breaches Using Gorilla RAT and Monkey Ransomware

#security #threatintel

1. Overview

2. Executive Summary

Hacking Cat exploits Exchange vulnerabilities for initial access, deploys Gorilla RAT for remote control and traffic relay, and proceeds to encryption and destruction using Monkey ransomware tailored for Windows, Linux, and ESXi. Capabilities vary by variant.

3. Attack Flow

1. From Exchange Compromise to Destruction

  1. According to Kaspersky, attackers exploit Exchange vulnerabilities for initial access. Specific CVEs are estimated candidates.
  2. Gorilla RAT is deployed and connects to the C2 server via WebSocket.
  3. Attackers use process and file operations, as well as TCP tunneling, to relay connections to internal services.
  4. Monkey ransomware and related payloads are deployed based on the target OS.
  5. Depending on the variant, payloads perform encryption, data destruction, or log clearing. Not all processes occur across every OS or incident.

4. Attacker Positioning and Execution Points

  • After gaining external access to Exchange, the attacker connects to internal services through the host running Gorilla RAT.

5. Visibility for Victims and Administrators

Victims

  • Post-encryption, the incident becomes apparent through inaccessible files and ransomware notes.

Administrators

  • Inference: Investigations typically begin with suspicious execution or WebSocket traffic on Exchange, followed by variant-specific service stops, log clearing, and file encryption.

6. Conditions for Success and Failure

Success Conditions

  • Reachable vulnerable or compromised Exchange servers.
  • Privileges to reach internal assets and virtualization infrastructure after RAT execution.

Failure Conditions and Risk Mitigation

  • Patching and restricting public access to Exchange, alongside assuming credential compromise.
  • Application control, network segmentation, and offline backups limit RAT deployment and encryption impact.

7. Impact of Successful Attacks

  • Remote control, file transfer, and TCP connection relay to internal services via Gorilla RAT.
  • File encryption on Windows, Linux, and ESXi by various Monkey variants. Some Rust variants do not save decryption keys, leading to unrecoverable destruction.
  • Disruption of investigation and recovery through variant-specific deletion of logs, history, and backups.

8. Observable Logs

Inference: Depending on logging configurations, the following records can support internal investigations:

Email

  • While Exchange is the entry point, there are no reports of malicious email attachments or links serving as the initial vector. Server compromise cannot be determined solely through email tracking logs.

Proxy, SWG, and DNS

  • Inference: Review Exchange web access logs along with destination addresses and timestamps for outbound WebSocket traffic. Cross-reference with published IOCs to distinguish from standard product traffic.

Endpoints and EDR

  • Inference: Check for server process execution, file placement, service stops, and cleared Windows event logs. Treat Run keys as characteristics of the predecessor reverse shell.

Authentication and IdP

  • Inference: Identify accounts and timestamps used to connect from compromised hosts to internal servers or virtualization infrastructure. TCP connections alone do not confirm successful authentication.

SaaS and Cloud

  • Inference: Check audit logs for virtualization and backup infrastructure to identify administrative actions, stopped jobs, and modifications to files or recovery data. This depends on the logging configuration of the targeted infrastructure.

Network

  • Inference: Correlate outbound WebSocket connections with TCP connections originating from that host to internal services. A communication interval of 27 to 36 seconds alone is insufficient to identify Gorilla RAT.

9. Determining Attack Success

Confirmable via Public Information

  • Confirmed Malware Execution or Authentication Success: Public Information: Kaspersky observational data confirms the execution of Gorilla RAT and Monkey across multiple attack incidents.
  • Confirmed Subsequent Compromise: Public Information: Post-RAT deployment encryption, destruction, and log deletion have been confirmed.

Internal Assessment Criteria

  • Confirmed Data Exfiltration or Session Compromise: Assessment Criteria: Evidence of exfiltrated files or credentials confirms data exfiltration. This is not uniformly confirmed in public data.

10. Investigation Playbook

Inference: The following steps outline an internal investigation process based on public information:

Investigation Starting Point

  • Begin with suspicious execution on Exchange, Gorilla RAT IOCs, or signs of encryption and log deletion.

Initial Verification

  • Verify Exchange exposure and patch status. Preserve samples, earliest execution or communication timestamps, and encryption start times. Do not limit investigations based on estimated CVEs alone.

Endpoints and Servers

  • Distinguish between samples of the predecessor reverse shell, Gorilla RAT, and Monkey. Verify execution, persistence, and destruction activities on each host.

Authentication and Cloud

  • Identify accounts and privileges used on compromised hosts and trace administrative connections to Windows, Linux, and ESXi environments.

Subsequent Activity

  • Investigate relayed internal hosts, additional file transfers, encryption, and the deletion of backups or logs in chronological order. Exfiltration must be determined through separate evidence.

Containment

  • Isolate confirmed compromised hosts and relay traffic, and protect backups. Patch Exchange, rotate related credentials, and proceed with recovery based on the impact scope.

Classification Categories

  • Record initial access, RAT execution, traffic relay, execution on secondary hosts, encryption and destruction, and data exfiltration separately.

11. Defense and Detection Ideas

Inference: The following are suggested detection and mitigation approaches based on public information:

Single Events

  • Target WebSocket connections from suspicious executables, service stops, event log clearing, and mass file modifications, while distinguishing them from maintenance activities.

Chronological Correlation

  • Correlate execution on Exchange, WebSocket connections, internal connections, and target host encryption/log clearing by host, timestamp, and account.

Threat Hunting

  • Prioritize internal assets connected from compromised hosts, cross-referencing Kaspersky IOCs and variant-specific behaviors. Do not classify malware solely based on beacon intervals or Run keys.

Log Gaps and Limitations

  • Post-encryption log clearing or insufficient auditing on Linux and ESXi may hinder tracking. Verify against centrally stored logs and network records.

Priority Mitigations

  • Prioritize patching and reducing the public exposure of Exchange, isolating internal administrative connections, and ensuring backup isolation and recovery verification. Do not conclude investigations by addressing infected endpoints alone.

12. Facts, Inferences, and Hypotheses

Facts

  • Hacking Cat has been active on Telegram since February 2024, shifting its focus from information disclosure to encryption and destruction around the summer of 2025.
  • Kaspersky associates Gorilla RAT and Monkey Ransomware with high confidence, as they have only been observed in this group's attacks.
  • Initial access is attributed to Exchange vulnerabilities, with Kaspersky listing CVE-2021-26855 and CVE-2026-42897 as estimated candidates. These are not confirmed CVEs for individual compromises.
  • The Go-based reverse shell preceding Gorilla RAT copies itself to %LOCALAPPDATA% and achieves persistence via registry Run keys. Kaspersky notes this was later replaced by the feature-expanded Gorilla RAT.
  • The Go-based Gorilla RAT features WebSocket C2 communication, pings at 27 to 36-second intervals, process and file operations, file transfer, and TCP tunneling. Some variants also include VNC capabilities. Whether the predecessor's Run key persistence applies to Gorilla RAT is unconfirmed in the original text.
  • Monkey includes variants written in Rust, .NET, C++, and Go, targeting Windows, Linux, and ESXi.
  • Certain Rust variants do not save decryption keys, leading to unrecoverable destruction. C++ variants include capabilities such as clearing Windows event logs, with service-stopping, defense-evasion, and recovery-impeding features varying by variant.
  • Kaspersky mentions the potential use of generative AI regarding code inconsistencies, but AI usage cannot be confirmed solely through public information.

Inference

  • Due to Gorilla RAT's traffic relay capabilities, investigations must cover not only the compromised Exchange server but also internal assets connected from it.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: Medium): Exchange vulnerabilities are reported as the entry point, though specific CVEs are estimated.
  • T1053.005 Scheduled Task/Job: Scheduled Task (Confidence: Medium): Scheduled tasks are used for persistence and execution depending on the variant.
  • T1112 Modify Registry (Confidence: High): The Go-based predecessor of Gorilla RAT registers in Run keys. This persistence method is not definitively attributed to all Gorilla RAT variants.
  • T1572 Protocol Tunneling (Confidence: High): Gorilla RAT provides TCP tunneling capabilities.
  • T1486 Data Encrypted for Impact (Confidence: High): Monkey encrypts files.
  • T1070.001 Indicator Removal: Clear Windows Event Logs (Confidence: High): C++ variants clear event logs.

14. Unknowns and Additional Investigation

  • Number of victim organizations and duration of compromise.
  • Exchange CVEs actually exploited in each incident.
  • Presence or absence of data exfiltration prior to encryption.
  • Whether generative AI was used to write the code.

15. Impact on SOCs and Organizations

While Kaspersky's analysis focuses on attacks against Russian organizations, the pathway of relaying connections from externally exposed Exchange servers to internal services and spreading destructive payloads across multiple OS environments is relevant to organizations with similar architectures globally. Connect records from initial entry servers, administrative accounts, and virtualization or backup infrastructure to determine variant behaviors and impact scopes.

16. Summary by Role

  • SOC: Correlate suspicious execution on Exchange, Gorilla RAT WebSocket traffic, internal connections, encryption, and log clearing. Do not identify malware based on communication intervals alone.
  • Administrators: Patch Exchange, reduce public exposure, and isolate affected assets including connections upon compromise. Verify compromise scope and credential exposure across ESXi and backup infrastructure.
  • Users: Immediately report signs of suspicious service stops, encryption, or remote control.

Top comments (0)