VORANT. Threat Intelligence Sign in Get the full feed

CrossRAT malware powers Dark Caracal espionage

routine threat government-nationaldefenseenergyfinancial-servicesmanufacturing

Researchers reverse-engineered CrossRAT, a cross-platform Java RAT used by the Dark Caracal espionage operation to surveil victims across 21+ countries.

This post is a technical teardown of CrossRAT, a Java-based cross-platform implant identified in the EFF/Lookout "Dark Caracal" report as part of a global, multi-platform cyber-espionage campaign. The analysis covers OS fingerprinting logic, OS-specific persistence mechanisms (LaunchAgent plists on macOS, autostart .desktop files on Linux, and HKCU Run registry keys on Windows), and the malware's C&C protocol, which connects to a hardcoded command server on port 2223. Capabilities include file system manipulation, screen capture, arbitrary file/DLL execution, and exfiltration, though a bundled keylogging library (jnativehook) appears unused in this v0.1 sample.

The underlying Dark Caracal campaign, per the referenced EFF/Lookout report, has exfiltrated hundreds of gigabytes of data from thousands of victims across 21+ countries, targeting governments, militaries, utilities, financial institutions, manufacturers, and defense contractors using primarily social engineering, phishing, and occasional physical access rather than novel exploits. Dark Caracal's toolset also includes the Windows-focused Bandook RAT alongside CrossRAT. At time of analysis, CrossRAT had near-zero antivirus detection (1/59 on VirusTotal), though its persistence artifacts (mediamgrs.jar, mediamgrs.plist/.desktop, or registry Run key entries) are readily identifiable to defenders and behavioral tools.

The author notes that while CrossRAT is not technically sophisticated and still labeled version 0.1, it is functionally complete enough to give attackers full remote control including file operations, screenshots, and arbitrary code execution across Windows, macOS, and Linux — a broad reach uncommon for surveillanceware at the time.

Mentioned in this report

Threat actors Dark Caracal
Malware BandookCrossRAT
Campaigns Dark Caracal

Detection guidance

Java-based Implant Persistence via Registry Run Key

ATT&CK T1547.001

Detects suspicious JAR file execution registered in Windows HKCU Run registry keys - typical pattern for cross-platform implants like CrossRAT establishing persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java-based Implant Persistence via Registry Run Key
description: Detects registry modification setting a Run key to execute a JAR file
  from user directory or temp - characteristic of Java-based malware persistence on
  Windows. Generalises on the registry path (HKCU\Software\Microsoft\Windows\CurrentVersion\Run),
  JAR execution, and suspicious file locations.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
    Details|contains:
    - javaw.exe
    - java.exe
    - cmd.exe
  filter_legitimate_java:
    Details|contains:
    - Program Files
    - ProgramData
  condition: selection and not filter_legitimate_java
falsepositives:
- Legitimate Java application installers registering startup entries
- Enterprise Java deployment tools managing application persistence
level: high
id: 4e8c77c5-651c-5a45-8827-b09eace044dd
status: experimental
author: Vorant

Suspicious JAR Execution with Embedded Keylogging Library

ATT&CK T1113

Detects JAR files being executed that load jnativehook library - indicative of screen capture or input monitoring capability typical of CrossRAT-style surveillance implants. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious JAR Execution with Embedded Keylogging Library
description: Detects Java process execution loading jnativehook library, commonly
  bundled in surveillance malware for screen capture or keystroke monitoring. Generalises
  on the library name and parent/child process relation (java spawning jnativehook
  load).
tags:
- attack.collection
- attack.t1113
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    ImageLoaded|contains: jnativehook
  filter_development:
    CommandLine|contains:
    - -Djava.io.tmpdir
    - src/
  condition: selection and not filter_development
falsepositives:
- Legitimate Java accessibility libraries loaded in development environments
- Open-source projects using jnativehook for accessibility features
level: medium
id: 730a7f27-9fdb-5e87-b964-7f40493c33db
status: experimental
author: Vorant

Suspicious JAR File Execution from User Temporary or AppData Directory

ATT&CK T1204

Detects Java process execution of JAR files from user temp, AppData, or Downloads directories - common distribution method for phishing-delivered malware like CrossRAT. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious JAR File Execution from User Temporary or AppData Directory
description: Detects java/javaw.exe executing JAR files from user-writable directories
  (Temp, AppData, Downloads) - typical pattern for phishing-delivered or user-executed
  malware. Generalises on the process-argument relation and suspicious source paths,
  not specific filenames.
tags:
- attack.execution
- attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    CommandLine|contains:
    - AppData\\Local\\Temp
    - AppData\\Roaming
    - \\Temp\\
    - \\Downloads\\
    CommandLine|endswith:
    - .jar
    - .jar"
  filter_legitimate_java_tools:
    CommandLine|contains:
    - Program Files
  condition: selection and not filter_legitimate_java_tools
falsepositives:
- Legitimate portable Java applications deployed to user temp directories
- User-initiated execution of downloaded open-source Java tools
level: medium
id: d38a0c05-67ac-5766-ad25-f1684c19f201
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x28.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free