F5 Labs analyzes SparkRAT open-source RAT architectural weaknesses, exploits an in-the-wild C2, and releases YARA rules
F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cyber Anarchy Squad against Russian and Belarusian targets. F5 Labs identified architectural weaknesses in SparkRAT that defenders can use for detection and disruption. Using a client configuration recovered in the wild, they built a neutered client, enumerated the C2 attack surface and developed an undisclosed exploit chain against a live C2 hosted on Oracle Cloud Infrastructure. They also released YARA rules and validated them against Malware Bazaar samples.
Detalhes técnicos
- SparkRAT is written in Go, so characteristic runtime artefacts make static detection easier. The client configuration is embedded and obfuscated inside the binary, which defeats hash-based detection but gives defenders a consistent place to extract it.
- Credentials are shipped in the embedded configuration. Communication is over WebSockets on HTTPS, with no certificate pinning, so person-in-the-middle inspection is possible.
- The operator UI and client API share the same HTTP port, and all API endpoints follow REST conventions. The operator UI requires no authentication by default.
- Operators can set non-default ports and URL paths. Updates are fetched via separate REST requests and referenced by Git commit SHA, which aids threat hunting and telemetry. Updates also inject the client configuration into newly built binaries.
- Operator commands are relayed over WebSockets to the client, which creates potential to attack the operator's browser.
- The C2 observed by F5 used a non-standard port and a URL path prefix, and ran on OCI Compute. It was offline at the time of writing.
- Hash IoCs are of limited use because unique binaries can be generated per configuration. F5's four YARA rules (vanilla build artefacts, ~90% of dependencies, ~50% of original methods, and a combined rule with a file-size check) produced no false positives against Malware Bazaar samples from 2020-02 to 2024-04. They matched 29 samples representing at least seven distinct variants.
- Relevant ATT&CK techniques: T1071, T1071.001, T1105.
Remediação
- Deploy the F5 Labs YARA rules (github.com/F5-Labs/SparkRAT-YARA-rules) instead of relying on hashes or simple string matches such as "Spark/client/config.GetBaseURL".
- Alert on atypical WebSocket traffic and use TLS inspection where possible, since the client does not pin certificates.
- Hunt for SparkRAT C2 infrastructure on non-default ports and URL paths, and use the configuration extracted from samples to profile C2 servers.
Linha do tempo
-
F5 Labs analyzes SparkRAT open-source RAT architectural weaknesses, exploits an in-the-wild C2, and releases YARA rules
ler a análise desta fonte ocultar
F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cyber Anarchy Squad against Russian and Belarusian targets. F5 Labs identified architectural weaknesses in SparkRAT that defenders can use for detection and disruption. Using a client configuration recovered in the wild, they built a neutered client, enumerated the C2 attack surface and developed an undisclosed exploit chain against a live C2 hosted on Oracle Cloud Infrastructure. They also released YARA rules and validated them against Malware Bazaar samples.
Technical Details
- SparkRAT is written in Go, so characteristic runtime artefacts make static detection easier. The client configuration is embedded and obfuscated inside the binary, which defeats hash-based detection but gives defenders a consistent place to extract it.
- Credentials are shipped in the embedded configuration. Communication is over WebSockets on HTTPS, with no certificate pinning, so person-in-the-middle inspection is possible.
- The operator UI and client API share the same HTTP port, and all API endpoints follow REST conventions. The operator UI requires no authentication by default.
- Operators can set non-default ports and URL paths. Updates are fetched via separate REST requests and referenced by Git commit SHA, which aids threat hunting and telemetry. Updates also inject the client configuration into newly built binaries.
- Operator commands are relayed over WebSockets to the client, which creates potential to attack the operator's browser.
- The C2 observed by F5 used a non-standard port and a URL path prefix, and ran on OCI Compute. It was offline at the time of writing.
- Hash IoCs are of limited use because unique binaries can be generated per configuration. F5's four YARA rules (vanilla build artefacts, ~90% of dependencies, ~50% of original methods, and a combined rule with a file-size check) produced no false positives against Malware Bazaar samples from 2020-02 to 2024-04. They matched 29 samples representing at least seven distinct variants.
- Relevant ATT&CK techniques: T1071, T1071.001, T1105.
Remediation
- Deploy the F5 Labs YARA rules (github.com/F5-Labs/SparkRAT-YARA-rules) instead of relying on hashes or simple string matches such as "Spark/client/config.GetBaseURL".
- Alert on atypical WebSocket traffic and use TLS inspection where possible, since the client does not pin certificates.
- Hunt for SparkRAT C2 infrastructure on non-default ports and URL paths, and use the configuration extracted from samples to profile C2 servers.