'MostereRAT' Malware Blends In, Blocks Security Tools

A new operation tracked by Fortinet’s FortiGuard Labs uses a banking malware turned remote access Trojan called MostereRAT to maintain long-term, persistent access on Windows systems. According to Fortinet, the campaign blends exotic techniques such as using Easy Programming Language (EPL), tampering with security tools, and covertly deploying legitimate remote access tools to conceal activity.

The malware, which can run as TrustedInstaller and disable AV/EDR products while blocking telemetry, also delivers up to 37 command functions and supports secure two-way authenticated C2 communications. The phishing-driven attack chain begins with malicious emails targeting Japanese Windows users, delivering a weaponised Word document that downloads the payload, with modules handling persistence, privilege escalation, and core RAT functions.

MostereRAT’s ability to deploy AnyDesk and TightVNC provides long-term remote access, raising concerns about evasion and the misuse of trusted software. The campaign highlights the need to block unapproved remote access tools and to restrict local administrator privileges to reduce attack surfaces.