New Python-Based RAT Disguised as Minecraft App Steals Sensitive User Data
Threat researchers have identified a new Remote Access Trojan (RAT) written in Python, disguised as "Nursultan Client," a known Minecraft application within Eastern-European and Russian gaming communities. This malware uses the Telegram Bot API for…
Threat researchers have identified a new Remote Access Trojan (RAT) written in Python, disguised as "Nursultan Client," a known Minecraft application within Eastern-European and Russian gaming communities. This malware uses the Telegram Bot API for command-and-control (C2) operations, allowing attackers to exfiltrate data and maintain access to compromised systems.
The RAT, discovered during threat hunting activities, is a 68.5 MB executable compiled with PyInstaller, a tool often used to package Python scripts into standalone files. Upon execution, it displays a fake installation progress bar to deceive users into believing they are installing legitimate software.
The malware's core functions, including C2 communications and surveillance, operate on Windows, Linux, and macOS systems , broadening its reach. The use of the Nursultan Client name in fake installation messages and registry keys highlights targeted social engineering tactics aimed at the gaming community.
The malware relies entirely on Telegram's Bot API for executing commands and data exfiltration. Researchers found hardcoded Telegram credentials, including a bot token and authorized user IDs, embedded within the executable. This method allows threat actors to conceal communications within a privacy-focused messaging platform, complicating detection efforts.
Upon execution, it displays a fake installation progress bar to deceive users into believing they are installing legitimate software.
Authorized attackers can issue commands to infected machines, facilitating targeted operations. The malware includes commands such as /tokens to collect Discord authentication tokens and /info for system reconnaissance, among others. Stolen tokens can compromise gaming communities, while the RAT enables further surveillance through /screenshot and /camera commands.
Indicators of Lower-Tier Threat Operations
The lack of advanced anti-analysis techniques and custom code obfuscation, along with a basic "ALLOWED_USERS" structure, suggests a Malware-as-a-Service model aimed at lower-level threat actors. The malware's flawed persistence mechanisms also indicate a lack of sophisticated tradecraft.
Organizations are advised to enhance visibility into encrypted traffic, monitor for unusual Telegram API communications, and ensure users verify software authenticity prior to installation to mitigate risks associated with this threat.
Based on reporting by GBHackers.