KRNRATMalware
According to Trend Micro, this is a rootkit with capabilities of a full-featured backdoor with various capabilities, including process manipulation, file hiding, shellcode execution, traffic concealment, and C&C communication. It is controlled through a range of IOCTL codes.From MISP Galaxy
Last reported 8 months ago, by JPCERT/CC Eyes1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1014Rootkit
“For persistence, combinations of rootkits, backdoors, and loaders are used.”
- T1053.005Scheduled Task
“Persistence was achieved by registering the malware in the Startup folder and creating scheduled tasks.”
- T1553.002Code Signing
“…onitoring persistence mechanisms with Autoruns and EDR solutions, and restricting AutoIt execution through AppLocker or WDAC based on code-signing information.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
JSAC2026 -Day 1-““KRNRAT” injects a user-mode agent into svchost.exe to maintain memory-resident execution.”
Thanks — we review every report.