Summary:
Researchers from Cyfirma have observed the latest version of a Windows RAT called Neptune RAT being distributed via GitHub using a notable technique that leverages 2 PowerShell commands.

• irm (Invoke-RestMethod): A PowerShell command used to download content from a URL.
• iex (Invoke-Expression): A PowerShell command that executes the downloaded content as a script.

Using these commands allows the adversary to use the malware to download and execute a batch script and Base64-encoded payload hosted as a text file on catbox[.]moe. This payload is dropped into the AppData folder and executed to establish a C2 connection between the client and the attacker-controlled server hosting Neptune RAT.

Neptune RAT’s capabilities make it a serious threat to organizations. Equipped with advanced defense and analysis evasion and persistence mechanisms, Neptune RAT can maintain a long-term foothold on a victim's system. This malware boasts a dangerous toolkit featuring a crypto clipper, a password stealer with the capabilities to exfiltrate over 270+ different applications’ credentials, ransomware capabilities, and the ability to remotely monitor the desktop in real time. Neptune RAT is written in Visual Basic .NET and has been marketed across platforms like GitHub, Telegram, and YouTube. According to Cyfirma, the developer of Neptune RAT has distributed the software without its source code available, deliberately making it difficult to analyze by obfuscating the executable files. While presented as a free tool, the creator hints that a more feature-rich, paid version exists. The RAT is obfuscated and replaces the original strings with Arabic characters and emojis to make it harder to analyze.

Security Officer Comments:
Despite claims of educational and ethical intent, the way Neptune RAT v2 is being used and spread is a significant risk to organizations. This report from Cyfirma highlights the anti-analysis techniques employed by Neptune RAT v2, new capabilities from the builder that make it easier than ever to use, and its ransomware and credential harvesting features. What makes this new variant of Neptune RAT a severe threat lies in its ability to generate and execute direct PowerShell commands (utilizing irm and iex), facilitating smooth deployment and execution and often bypassing typical security controls. The sophistication of this malware, coupled with its ease-of-use through the customized GUI builder, warrants continuous monitoring, robust endpoint protection, and proactive threat detection strategies, which are critical to mitigating the impact of this comprehensive malware.

Suggested Corrections:
IOCs are available here.

Recommendations from Cyfirma:

• Implement threat intelligence to detect indicators of compromise (IOCs) associated with Neptune RAT, including known malicious IPs, domains, and file hashes. Use advanced endpoint protection platforms (EPP) with real-time monitoring to identify unusual behaviours. Deploy host-based intrusion prevention systems (HIPS) to block suspicious activities at the endpoint level.
• Restrict PowerShell script execution through application control policies, disabling the use of irm and iex commands unless explicitly required. Configure firewalls to block outbound connections to suspicious domains like catbox.moe and known C2 servers. Use DNS filtering to prevent access to malicious domains.
• Apply strict access controls and least privilege principles to limit administrative access. Enable multi-factor authentication (MFA) to reduce the risk of credential theft. Implement endpoint detection and response (EDR) solutions for initiative-taking threat detection and forensic analysis.
• Conduct regular vulnerability scans and penetration testing to identify weaknesses in the network. Apply security patches and updates promptly to minimize exposure to known vulnerabilities.
• Monitor for suspicious file modifications, especially changes to file extensions like . ENC, along with unusual network connections and unexpected process executions. Utilize Security Information and Event Management (SIEM) tools to detect, analyse, and correlate these suspicious activities for timely threat identification.
• Establish a comprehensive incident response plan to manage infections effectively, including isolation, analysis, and remediation procedures. Provide ongoing cybersecurity training to employees to recognize phishing and social engineering tactics.
• Ensure strong email security filters to detect and block malicious attachments or links. Regularly back up critical data and verify recovery procedures to mitigate the impact of ransomware attacks. Continuously review and update security policies to address emerging threats.

Link(s):
https://www.cyfirma.com/research/neptune-rat-an-advanced-windows-rat-with-system-destruction-capabilities-and-password-exfiltration-from-270-applications/