FatalRAT

FatalRAT is a Windows remote access trojan used in campaigns targeting Chinese-language users in Southeast Asia, East Asia, and the broader Asia-Pacific region. Reported targeting has included government and corporate networks, and activity has been associated in multiple reports with Chinese state-sponsored or China-nexus intrusion activity. FatalRAT has also been linked to the broader Chinese-speaking crimeware ecosystem alongside families such as Gh0st RAT, Simay RAT, Winos4.0, and ValleyRAT.

Observed delivery and execution chains have relied on social engineering and search-engine poisoning, including malicious search results for popular software and messaging applications that lead victims to trojanized installers. FatalRAT has also been deployed through DLL sideloading, including abuse of legitimate software components to load the malware while blending into normal application execution. Some reported samples were protected with commercial packers to hinder analysis.

Once installed, FatalRAT provides remote access and post-compromise control over infected systems through command-and-control communications using both a custom protocol and traffic designed to resemble normal encrypted web activity. Its use in targeted campaigns indicates a role in sustained intrusion operations rather than opportunistic nuisance activity. The malware has been observed as part of multi-tool intrusion sets, suggesting operators use it in conjunction with other remote access tools depending on victim environment and operational goals.