MostereRAT: The New RAT That Is Bypassing Antivirus and EDR Solutions

MostereRAT: The New RAT That Is Bypassing Antivirus and EDR Solutions, published on 9 September 2025, reports a sophisticated phishing campaign that deploys a new Remote Access Trojan dubbed MostereRAT. According to FortiGuard Labs, the campaign begins with phishing emails targeting Japanese users that mimic business inquiries to entice recipients to click malicious links, leading them to a site where a malicious Word document is downloaded and executed via an embedded payload.

The malware uses Easy Programming Language (EPL) to stage execution, with an EPL-based loader employing .epk files and a custom launcher to run modular payloads, while encrypted payloads are hidden alongside images of famous people. It creates services such as WpnCoreSvc and WinSvc_ to achieve persistence and can escalate privileges by impersonating TrustedInstaller, enabling system-level access.

FortiGuard notes that MostereRAT actively neutralises defences by maintaining lists of security product paths and names and by blocking the tools’ network communications, deleting files like wuaueng.dll and terminating SecurityHealthService.exe to disable Windows security services.