DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal

DRAT V2 updates its C2 obfuscation

by adding junk strings before Base64-

encoding IPs, likely to impede basic

decoding and evade detection by

automated tools.

TAG-140 continues to favor

simplicity over stealth by using

ClickFix-style social engineering

attacks, initiating the attacks with

a cloned Indian Ministry of Defence

press portal.

CYBER

THREAT

ANALYSIS

CYBER THREAT ANALYSIS

Executive Summary

During an investigation into a recent TAG-140 campaign targeting Indian government organizations, Insikt Group identif…