New VectraRAT Malware Service Targets Windows Networks for $250 Monthly

SOCRadar researchers have uncovered VectraRAT, a previously undocumented malware-as-a-service platform offered for $250 per month. The service includes a Windows implant, Linux command-and-control (C2) infrastructure and an operator panel, all reportedly developed from scratch by the same creator rather than adapted from existing malware.

Researchers found the platform on 23 June after investigating an open directory, examining more than 10 servers, dozens of samples and logs belonging to real operators, and reviewing a Telegram conversation with its developer.

VectraRAT is delivered through the Amadey loader and ClickFix social-engineering pages. Once installed, it can provide a hidden desktop, remote CMD and PowerShell access, keylogging, file transfer, process discovery, clipboard manipulation and SOCKS5 proxying. It also automatically collects browser credentials and searches for `.env`, `.conf` and `.config` files.

A UAC-bypass technique can obtain a high-integrity process without the usual elevation prompt, potentially giving attackers greater control of a compromised workstation. SOCRadar confirmed file exfiltration and said 48% of victim entries involved corporate Windows editions, including Windows Enterprise, Enterprise LTSC, IoT Enterprise LTSC and Windows Server 2025. The US, Russia and Germany were the most represented regions, although no specific sector or geographic targeting was established.

SOCRadar supplied indicators of compromise including a C2 override file, outbound TCP port 3308 associated with auto-elevation abuse, a debug API sequence and hidden PowerShell activity. It also highlighted that a verification page asking users to open the Run dialogue and paste a command is not legitimate, helping organisations block the ClickFix delivery route.