# CrossRAT malware powers Dark Caracal espionage

Published: 2026-08-02 · Severity: high · Sectors: government-national, defense, energy, financial-services, manufacturing
Canonical: https://vorant.io/reports/246f83ba-14de-5bac-945a-520a7948e80a/crossrat-malware-powers-dark-caracal-espionage

> Researchers reverse-engineered CrossRAT, a cross-platform Java RAT used by the Dark Caracal espionage operation to surveil victims across 21+ countries.

This post is a technical teardown of CrossRAT, a Java-based cross-platform implant identified in the EFF/Lookout "Dark Caracal" report as part of a global, multi-platform cyber-espionage campaign. The analysis covers OS fingerprinting logic, OS-specific persistence mechanisms (LaunchAgent plists on macOS, autostart .desktop files on Linux, and HKCU Run registry keys on Windows), and the malware's C&C protocol, which connects to a hardcoded command server on port 2223. Capabilities include file system manipulation, screen capture, arbitrary file/DLL execution, and exfiltration, though a bundled keylogging library (jnativehook) appears unused in this v0.1 sample.

The underlying Dark Caracal campaign, per the referenced EFF/Lookout report, has exfiltrated hundreds of gigabytes of data from thousands of victims across 21+ countries, targeting governments, militaries, utilities, financial institutions, manufacturers, and defense contractors using primarily social engineering, phishing, and occasional physical access rather than novel exploits. Dark Caracal's toolset also includes the Windows-focused Bandook RAT alongside CrossRAT. At time of analysis, CrossRAT had near-zero antivirus detection (1/59 on VirusTotal), though its persistence artifacts (mediamgrs.jar, mediamgrs.plist/.desktop, or registry Run key entries) are readily identifiable to defenders and behavioral tools.

The author notes that while CrossRAT is not technically sophisticated and still labeled version 0.1, it is functionally complete enough to give attackers full remote control including file operations, screenshots, and arbitrary code execution across Windows, macOS, and Linux — a broad reach uncommon for surveillanceware at the time.

## Mentioned in this report

- Threat actors: Dark Caracal
- Malware: Bandook, CrossRAT
- Campaigns: Dark Caracal

Source reporting: https://objective-see.org/blog/blog_0x28.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/246f83ba-14de-5bac-945a-520a7948e80a/crossrat-malware-powers-dark-caracal-espionage.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup