{
  "family": "immirat",
  "sample_count": 17,
  "category": "ransomware",
  "description": "Backdoor:Win32/Immirat is a Remote Access Trojan (RAT) designed to provide an attacker with complete, stealthy, and persistent administrative control over a compromised Windows endpoint. It is frequently utilized in targeted espionage campaigns or by Initial Access Brokers (IABs) to establish a foothold before selling access to ransomware operators.<br><br><b>Understanding Immirat</b><br>To an end-user, an Immirat infection is entirely invisible, operating silently in the background. For a security analyst, a RAT represents a critical breach of the endpoint. Immirat is not an automated worm; it is a tool operated by a human adversary (hands-on-keyboard). The attacker uses the Immirat C2 server to issue real-time commands, browse the file system, exfiltrate data, and monitor the user's activities.<br><br><b>Execution and Remote Control Mechanics</b><br>Immirat is typically deployed via spearphishing campaigns containing weaponized attachments (`T1566.001`) or dropped by other initial access malware. Upon execution, it establishes persistence, often by creating a hidden scheduled task or installing itself as a Windows service (`T1543.003`). The RAT heavily obfuscates its executable (`T1027`) and often injects its core communication module into legitimate processes like `svchost.exe` (`T1055`) to evade EDR detection. Once active, Immirat opens a reverse shell or establishes an encrypted command channel (often over HTTPS or custom TCP protocols) back to the attacker's infrastructure (`T1105`). The attacker can then utilize built-in modules to log keystrokes (`T1056.001`), capture screenshots (`T1113`), activate the webcam, and exfiltrate sensitive files.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise, data theft, and the high probability of lateral movement. EDR platforms must alert on anomalous child processes spawning from generic host processes, or the unauthorized creation of system services. Network logs will reveal sustained, long-lived connections (beaconing) to unknown, external IP addresses. Forensic analysis of the registry and Task Scheduler is required to uncover the persistence mechanisms.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1105",
    "T1055",
    "T1113",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network; an active, human adversary is likely controlling the machine in real-time.",
    "Assume all local credentials and session tokens on the machine have been compromised and initiate enterprise-wide password resets.",
    "Capture a forensic memory image (RAM dump) to extract the decrypted C2 configuration and analyze any active reverse shell connections.",
    "Hunt for lateral movement originating from the infected machine by analyzing Windows Event Logs (e.g., Event ID 4624 for successful network logons)."
  ],
  "what_to_avoid": [
    "Do not simply delete the RAT executable and leave the machine on the network; the attacker may have already established secondary backdoors or compromised other hosts.",
    "Avoid relying solely on static AV scans, as RATs frequently update their payloads and inject into memory to evade file-based detection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}