STRRAT

STRRAT, also known as Strigoi Master, is a Java-based remote access trojan targeting Windows systems. Active since at least 2020, it is commonly distributed through phishing and malspam campaigns using malicious JAR attachments, macro-enabled Office documents, Java-based downloaders, and archives or installer files crafted to disguise the payload. Some campaigns bundle a Java Runtime Environment so the malware can execute even when Java is not already installed, while others rely on Java already being present. STRRAT has also been observed appended to MSI installers to hinder superficial analysis.

The malware provides broad remote administration and post-compromise functionality. It can execute shell and PowerShell commands, manage files, enumerate processes, capture the screen, and operate a reverse proxy. STRRAT supports credential theft from multiple browsers and email clients, including Chromium-based browsers, Firefox, Outlook, Thunderbird, and Foxmail, and includes both keylogging and offline log collection capabilities. It performs host reconnaissance and can attempt privilege escalation. Persistence has been observed through Startup-folder placement, scheduled tasks, and Windows Run-key autoruns.

Some variants can deploy components associated with hidden or wrapped Remote Desktop access to enable interactive remote control. STRRAT also contains a ransomware-themed module. In stronger implementations, this module encrypts user files in common profile directories and can display a ransom note; in other observed variants, it merely renames files with a dedicated extension without performing real encryption. This indicates the family has evolved over time and that capability may vary by sample.

STRRAT is frequently associated with commodity cybercrime activity rather than bespoke espionage tooling. It has been linked to phishing operations targeting business users with shipping, payment, order, and request-themed lures, and has appeared in campaigns affecting sectors such as aviation, aerospace, transportation, manufacturing, and defense through actors including TA2541. It has also been used historically by the cluster tracked as Bloody Wolf before that actor shifted toward abusing legitimate remote administration software. The malware is commonly obfuscated, including with Java obfuscators, and uses encrypted configuration data to conceal command-and-control settings and hinder analysis.