CrossRAT malware powers Dark Caracal espionage

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine threat Several sectors (5)

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Researchers reverse-engineered CrossRAT, a cross-platform Java RAT used by the Dark Caracal espionage operation to surveil victims across 21+ countries.

Sourceobjective-see.org — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

This post is a technical teardown of CrossRAT, a Java-based cross-platform implant identified in the EFF/Lookout "Dark Caracal" report as part of a global, multi-platform cyber-espionage campaign. The analysis covers OS fingerprinting logic, OS-specific persistence mechanisms (LaunchAgent plists on macOS, autostart .desktop files on Linux, and HKCU Run registry keys on Windows), and the malware's C&C protocol, which connects to a hardcoded command server on port 2223. Capabilities include file system manipulation, screen capture, arbitrary file/DLL execution, and exfiltration, though a bundled keylogging library (jnativehook) appears unused in this v0.1 sample.

The underlying Dark Caracal campaign, per the referenced EFF/Lookout report, has exfiltrated hundreds of gigabytes of data from thousands of victims across 21+ countries, targeting governments, militaries, utilities, financial institutions, manufacturers, and defense contractors using primarily social engineering, phishing, and occasional physical access rather than novel exploits. Dark Caracal's toolset also includes the Windows-focused Bandook RAT alongside CrossRAT. At time of analysis, CrossRAT had near-zero antivirus detection (1/59 on VirusTotal), though its persistence artifacts (mediamgrs.jar, mediamgrs.plist/.desktop, or registry Run key entries) are readily identifiable to defenders and behavioral tools.

The author notes that while CrossRAT is not technically sophisticated and still labeled version 0.1, it is functionally complete enough to give attackers full remote control including file operations, screenshots, and arbitrary code execution across Windows, macOS, and Linux — a broad reach uncommon for surveillanceware at the time.

Mentioned in this report

Threat actors Dark Caracal

Malware BandookCrossRAT

Campaigns Dark Caracal

Detection guidance

Java-based Implant Persistence via Registry Run Key

ATT&CK T1547.001 · status experimental · needs windows registry_set logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects suspicious JAR file execution registered in Windows HKCU Run registry keys - typical pattern for cross-platform implants like CrossRAT establishing persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java-based Implant Persistence via Registry Run Key
description: Detects registry modification setting a Run key to execute a JAR file
  from user directory or temp - characteristic of Java-based malware persistence on
  Windows. Generalises on the registry path (HKCU\Software\Microsoft\Windows\CurrentVersion\Run),
  JAR execution, and suspicious file locations.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
    Details|contains:
    - javaw.exe
    - java.exe
    - cmd.exe
  filter_legitimate_java:
    Details|contains:
    - Program Files
    - ProgramData
  condition: selection and not filter_legitimate_java
falsepositives:
- Legitimate Java application installers registering startup entries
- Enterprise Java deployment tools managing application persistence
level: high
id: 4e8c77c5-651c-5a45-8827-b09eace044dd
status: experimental
author: Vorant

Suspicious JAR Execution with Embedded Keylogging Library

ATT&CK T1113 · status experimental · needs windows image_load logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects JAR files being executed that load jnativehook library - indicative of screen capture or input monitoring capability typical of CrossRAT-style surveillance implants. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious JAR Execution with Embedded Keylogging Library
description: Detects Java process execution loading jnativehook library, commonly
  bundled in surveillance malware for screen capture or keystroke monitoring. Generalises
  on the library name and parent/child process relation (java spawning jnativehook
  load).
tags:
- attack.collection
- attack.t1113
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    ImageLoaded|contains: jnativehook
  filter_development:
    CommandLine|contains:
    - -Djava.io.tmpdir
    - src/
  condition: selection and not filter_development
falsepositives:
- Legitimate Java accessibility libraries loaded in development environments
- Open-source projects using jnativehook for accessibility features
level: medium
id: 730a7f27-9fdb-5e87-b964-7f40493c33db
status: experimental
author: Vorant

Suspicious JAR File Execution from User Temporary or AppData Directory

ATT&CK T1204 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects Java process execution of JAR files from user temp, AppData, or Downloads directories - common distribution method for phishing-delivered malware like CrossRAT. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious JAR File Execution from User Temporary or AppData Directory
description: Detects java/javaw.exe executing JAR files from user-writable directories
  (Temp, AppData, Downloads) - typical pattern for phishing-delivered or user-executed
  malware. Generalises on the process-argument relation and suspicious source paths,
  not specific filenames.
tags:
- attack.execution
- attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    CommandLine|contains:
    - AppData\\Local\\Temp
    - AppData\\Roaming
    - \\Temp\\
    - \\Downloads\\
    CommandLine|endswith:
    - .jar
    - .jar"
  filter_legitimate_java_tools:
    CommandLine|contains:
    - Program Files
  condition: selection and not filter_legitimate_java_tools
falsepositives:
- Legitimate portable Java applications deployed to user temp directories
- User-initiated execution of downloaded open-source Java tools
level: medium
id: d38a0c05-67ac-5766-ad25-f1684c19f201
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x28.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs