MostereRAT Exploits AnyDesk and TightVNC for Remote Access on Windows Systems

MostereRAT exploits AnyDesk and TightVNC to gain remote access on Windows systems, with FortiGuard Labs noting a phishing campaign that delivers the trojan to compromise machines.

The attack begins with emails targeting Japanese users, directing victims to malicious websites that download a weaponized Word document containing a ZIP archive, and the document instructs the user to “OpenTheDocument.” The malware includes encrypted components and uses a custom RPC client, CreateSvcRpc, to interact with the Windows Service Control Manager and create SYSTEM-privileged services while avoiding standard API detection.

It hides activities with decoy images and leverages an EPL-based payload that deploys to C:\ProgramData\Windows and uses scheduled tasks named Microsoft\Windows\winrshost and Microsoft\Windows\winresume for persistence under SYSTEM and Administrator accounts. The campaign also deploys legitimate remote access tools such as AnyDesk, TightVNC, and RDP Wrapper, enabling covert, persistent access, and the malware supports 37 commands for extensive system control.

According to FortiGuard Labs, MostereRAT’s communication uses a magic number 1234567890, mutual TLS, and sophisticated privilege escalation via the TrustedInstaller account.