{
  "family": "atomicrat",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nAtomicRAT is a highly capable Remote Access Trojan (RAT) engineered to provide attackers with covert, persistent, and interactive control over compromised endpoints. While historically associated with macOS targeting, variants of AtomicRAT have evolved to target Windows environments as well, acting as a powerful espionage and data exfiltration tool for sophisticated threat actors.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAtomicRAT is primarily distributed via highly targeted spear-phishing campaigns. These campaigns often leverage socially engineered lures (e.g., fake job offers or urgent corporate communications) containing weaponized documents or deceptive ZIP archives.\n\nUpon successful execution, AtomicRAT focuses on establishing a deep, persistent foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> The RAT establishes a persistent connection to its command-and-control (C2) server. To evade network detection, it frequently utilizes encrypted communications over standard web ports (HTTPS/443) or leverages legitimate cloud infrastructure (like Telegram APIs or public cloud buckets) as a proxy.</li>\n<li><strong>Comprehensive Espionage:</strong> AtomicRAT provides the attacker with a vast array of surveillance capabilities. This includes full file system manipulation, real-time keylogging, periodic desktop screen capturing, and the ability to silently activate connected webcams or microphones.</li>\n<li><strong>Credential Harvesting:</strong> A primary objective is credential theft. The RAT actively scans for and extracts saved passwords from web browsers, cryptocurrency wallet files, and secure enclave/keychain data (on macOS).</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn AtomicRAT infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker, leading to the immediate loss of intellectual property, compromised user credentials, and the high likelihood of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately to halt the C2 communication and prevent active data exfiltration.</li>\n<li><strong>Forensic Memory Analysis:</strong> Because advanced RATs often attempt to hide their processes, perform memory forensics to identify the injected threads and extract the specific C2 configuration for enterprise-wide IOC blocking.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset for the affected user.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "OSX.AtomicRAT",
    "Trojan.Atomic",
    "Backdoor.AtomicRAT"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1056.001",
    "T1113",
    "T1125"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:37:00Z",
  "type": "RAT",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}