ZynorRAT Exploits Windows and Linux Systems to Gain Remote Access

During a threat-hunting exercise, the Sysdig Threat Research Team (TRT) identified a new sample dubbed ZynorRAT, a Go-based Remote Access Trojan that targets both Linux and Windows systems. It first appeared on VirusTotal on 8 July 2025, and TRT notes it shows no significant overlap with known malware families, with multiple reuploads indicating ongoing attempts to evade detection.

The malware uses Telegram as its C2 backbone, and its Linux variant compiles into a 64-bit ELF executable of nearly 10 MB, with symbols and artifacts kept in clear text to aid reverse engineering. A Windows build exists but retains Linux-only persistence logic, suggesting the author prioritised detection-evasion testing over cross-platform completeness; nonetheless, the Windows binary includes the full C2 feature set.

ZynorRAT establishes a Telegram bot named “lraterrorsbot” for its C2 communications, enabling file exfiltration, system enumeration, screenshot capture, and arbitrary shell command execution, with directory listings and metrics gathered via specific Go functions. Mitigations include monitoring outbound DNS/HTTP and systemd user services, and applying a Yara rule to detect ZynorRAT binaries, as organisations prepare for emerging threats targeting both Linux and Windows environments.