Proton RATMalware
- Calisto
Proton RAT is a Remote Access Trojan (RAT) specifically designed for macOS systems. It is known for providing attackers with complete remote control over the infected system, allowing the execution of commands, keystroke capturing, access to the camera and microphone, and the ability to steal credentials stored in browsers and other password managers.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1114.003Email Forwarding Rule
“They may also create email forwarding rules that automatically redirect incoming messages to an attacker controlled email address, enabling continued information gathering even after the victim resets their account.”
- T1213.005Messaging Applications
“Additionally, we observed the use of secured messaging applications like Signal, Session, SimpleX, and Tox for similar purposes, although far less popular.”
- T1684Social Engineering
“The following section outlines the typical approaches used by attackers, from social engineering lures to Business Email Compromise (BEC) attacks.”
- T1684.002Email Spoofing
“These features may include proxy servers rotation, obfuscation of attachments, and email spoofing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
French NGO reporters without borders targeted by Calisto“French NGO reporters without borders targeted by Calisto”
-
Global analysis of Adversary-in-the-Middle phishing threats“It is essential to note AitM phishing is also leveraged by espionage groups, such as the Russian state-sponsored intrusion set Calisto, as well as various Chinese groups.”
Indicators in its reports
named in the reports above- account.simpleasip[.]orgin 1 report
- scorelikelygateway.simleasip[.]orgin 1 report
- hxxps://account.proton[.]me/assets/static/public-index.7162a3fd.jsin 1 report
- 196.44.117[.]196in 1 report
- hxxps://admin.artemood[.]com/vendor/plugx/*.phpin 1 report
- admin.artemood[.]comin 1 report
- hxxps://mittalcpa[.]com/wp-content/plugins/bungs/*.phpin 1 report
- mittalcpa[.]comin 1 report
- hxxps://esclerosemultiplario.com[.]br/wp-content/plugins/areada/*.phpin 1 report
- esclerosemultiplario.com[.]brin 1 report
- hxxps://myoseguridad[.]net/prueba/phantomrise/*.phpin 1 report
- myoseguridad[.]netin 1 report
- hxxps://esourcesol[.]com/wp-content/plugins/leykos/*.phpin 1 report
- esourcesol[.]comin 1 report
- hxxps://cranium[.]id/plugins/unite/*.phpin 1 report
- cranium[.]idin 1 report
- sopatrasoftware[.]netin 1 report
- setimgfont[.]comin 1 report
- ageyeboo[.]comin 1 report
- doggiewalkietalkie[.]companyin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.