New DesckVB RAT with Multi-stage Infection Chain and Plugin-Based Architecture
A new version of the DesckVB Remote Access Trojan (RAT), version 2.9, has been identified in active malware campaigns as of early 2026. This modular RAT, developed using the .NET framework, exhibits sophisticated capabilities designed to maintain control…
A new version of the DesckVB Remote Access Trojan (RAT), version 2.9, has been identified in active malware campaigns as of early 2026. This modular RAT, developed using the .NET framework, exhibits sophisticated capabilities designed to maintain control over compromised systems while avoiding detection by conventional security measures.
The malware's initial attack vector is an obfuscated Windows Script Host (WSH) JavaScript file. This file executes critical tasks such as copying itself to public user directories and running via the wscript engine, which helps to obscure its activities. By leveraging native Windows components, the malware blends its malicious traffic with legitimate system processes, complicating detection.
The initial stage of the attack sets the foundation for a more potent payload. The infection chain proceeds to a PowerShell stage that performs thorough anti-analysis checks, verifying internet connectivity and scanning for debugging tools to ensure a secure execution environment before downloading the core malicious components. This process helps the malware avoid execution in sandboxed environments.
The DesckVB RAT is characterized by its stability and stealth. It utilizes a fileless .NET loader to execute directly in memory, leaving no physical footprint on the disk. This approach enables it to bypass many static file scanning defenses, making forensic analysis challenging.
A new version of the DesckVB Remote Access Trojan (RAT), version 2.9, has been identified in active malware campaigns as of early 2026.
DesckVB RAT features a robust plugin-based architecture that allows for dynamic capability extension. Operators can deploy specific modules post-compromise based on the target's value, rather than bundling all functions into a single executable. Verified plugins include a keylogger, a webcam streamer using DirectShow, and an antivirus enumerator. These modules are delivered via a custom TCP protocol that uses unique delimiters for payload management.
This architecture transforms the RAT from a simple backdoor into a versatile espionage tool, adaptable to various operational needs without requiring complete re-infection of the host system.
Security professionals are advised to focus on behavioral detection to mitigate this threat. Monitoring for unusual wscript.exe execution and PowerShell scripts that build decimal byte arrays can provide early warning signs. Ensuring endpoint detection systems are tuned to detect reflective code loading is essential for effective mitigation against these evolving attacks.
Based on reporting by Cyber Security News.