Meet ZynorRAT: The New Cross-Platform Malware Controlled via Telegram

The Sysdig Threat Research Team has identified ZynorRAT as a cross‑platform Remote Access Trojan written in Go, targeting both Linux and Windows, with its core C2 infrastructure built around Telegram bots. It is in early development, offering traditional RAT capabilities alongside real‑time command delivery via a Telegram bot, enabling quick responses from victim machines.

According to Sysdig, the malware was first uploaded to VirusTotal on 8 July 2025, with initial vendor detections at 22 of 66 and then dropping to 16/66 as visibility was seemingly reduced by the developer. Persistence relies on systemd user services, including disguised entries such as system-audio-manager[.]service to reload on startup, while the Windows version appears incomplete and Linux‑centric in its persistence logic.

Telegram bot “lraterrorsbot” serves as the main C2 channel, and testing indicates the malware has been run on cloud hosts and Turkish IP addresses linked to the attacker. Sysdig notes that it is plausible the attacker’s name or nickname may be “halil,” suggesting the work of a single individual, with potential plans to market the RAT in underground channels once development stabilises.