How the RSM Defense Threat Hunting Team uncovered a sophisticated fileless RAT using one of their 300+ in-house custom detections
Published by the RSM Defense Threat Hunting Team
Author: Justin Dolgos, Threat Hunting Supervisor
The Short Version
Every organization generates noise. Millions of events, thousands of alerts, and endless telemetry pour into a security operations center every day, and nearly all of it is harmless. Buried somewhere inside that volume are the handful of signals that actually matter, and finding them is the job of a threat hunter.
Recently, one of the RSM Defense Threat Hunting Team’s 300+ custom detections surfaced exactly that kind of signal: an unusual behavioral pattern involving anonymous communications infrastructure, which is activity most enterprise environments never legitimately produce. What initially appeared to be a minor anomaly quickly evolved into a full-scale malware investigation.
What the team found was a sophisticated fileless remote access trojan (RAT) built on a PowerShell-based loader, a portable Node.js runtime, encrypted command-and-control communications routed through anonymous infrastructure, and dynamic in-memory code execution. Every one of those design choices served the same purpose, which was to minimize forensic visibility while giving an attacker extensive remote access to the host.
Nothing about it matched a known signature. No publicly available indicator pointed to it. No automated tool labeled it as malicious.
|
The point It was discovered because the RSM Defense Threat Hunting Team recognized that something simply did not belong. |
The Problem With Modern Malware
There was a time when malware looked like malware. Attackers dropped suspicious executables. Security products identified known signatures. Defenders blocked malicious files.
That world is disappearing.
Today, attackers increasingly rely on legitimate software components, open-source frameworks, encrypted communications, fileless execution techniques, and modular architectures specifically designed to blend in with normal operating system activity.
Rather than deploying large, obvious malware binaries, modern adversaries often establish lightweight footholds that retrieve capabilities later, dynamically adapting as objectives change.
That evolution has fundamentally changed the detection problem. If malicious activity increasingly resembles legitimate activity, defenders must shift their focus away from what malware looks like and toward how it behaves.
That is where threat hunting becomes critical.
Why We Built the Detection
One of the biggest misconceptions about threat hunting is that it is simply an investigative function.
At RSM Defense, threat hunting is also a detection engineering function.
Every week, our threat hunters conduct hypothesis-driven investigations focused on emerging attacker tradecraft, newly observed techniques, and potential blind spots within modern security programs.
Those hunts generate intelligence. That intelligence becomes detections. Those detections become protection.
|
Threat Hunting Team Fact The RSM Defense Threat Hunting Team maintains more than 300 custom detections engineered from real-world attacker behavior. Each detection exists because a threat hunter found something worth catching. |
The investigation described in this article began with one of those detections. The rule was designed to identify behaviors associated with anonymous infrastructure and hidden services, activity that is relatively uncommon within most enterprise environments.
When the detection fired, the hunting team started asking questions.
Pulling the Thread
The initial alert was not a malware alert. It was not associated with a known malware family. It was not triggered by a file hash. It was not classified as a confirmed compromise.
It was a behavioral anomaly. Those are often the most valuable signals.
As the investigation progressed, analysts discovered that the activity was part of a sophisticated multi-stage attack chain built around a fileless remote access trojan.
An initial PowerShell-based loader established persistence, acquired supporting runtime components, and maintained communications with attacker-controlled infrastructure. Rather than deploying all functionality at the time of infection, the threat dynamically acquired a Node.js runtime, established encrypted communications through anonymous infrastructure, and retrieved additional capabilities from a remote command-and-control environment.
Most notably, much of the malware functionality never existed as a traditional executable on disk. Capabilities were delivered dynamically and executed directly in memory, significantly reducing the forensic footprint typically associated with malware investigations.
To a defender reviewing isolated events, much of the activity appeared legitimate. That was the point.
The malware intentionally leveraged trusted software components, encrypted communications, and anonymous infrastructure in an effort to blend into normal activity while providing operators with a powerful remote access platform behind the scenes.
Behind the Onion Address
One of the most significant findings uncovered during the investigation was a hidden service operating within the Tor network.
Investigators identified the following defanged command-and-control infrastructure:
|
hxxp://yuhvgbzsa66biqeatbmdvfo5b5jjefcmz5t2vjuvco5qtdkshfpabyid[.]onion:8443 |
This infrastructure was far more than a simple communications channel. It functioned as the operational backbone of the malware.
The PowerShell loader established connectivity through Tor and reached out to the hidden service to retrieve a second-stage payload containing the malware primary functionality. Rather than delivering everything during the initial infection, the threat dynamically downloaded capabilities after communications with attacker-controlled infrastructure were established.
This architecture provided several advantages to the attacker:
Most importantly, the infrastructure enabled remote command execution. Once communications were established, operators could remotely interact with compromised systems, execute commands, gather intelligence, profile the environment, transfer files, and deliver additional modules directly into memory.
|
Why the onion address mattered The question was no longer simply “Did malware execute?” The better question became “What capabilities did the attacker have available through Stage 2 and the C2 channel?” The answer was substantial. |
Built to Stay Hidden
What made this threat particularly interesting was not simply that it was a RAT. It was how the RAT was designed.
During analysis, the malware was observed supporting capabilities commonly associated with advanced remote access platforms, including:
Perhaps the most interesting capability uncovered during the investigation was the malware ability to receive entirely new functionality directly from its command-and-control infrastructure.
Instead of relying solely on capabilities present during the initial infection, operators could remotely deliver additional modules and execute them in memory. In practical terms, that meant the malware could evolve after deployment without creating many of the traditional file-based artifacts defenders expect to see during an investigation.
This was not opportunistic malware. This was modern attacker tradecraft.
Technical Indicators We Observed
One of the advantages of threat hunting is that every investigation creates opportunities to identify similar activity elsewhere.
During analysis, the RSM Defense Threat Hunting Team identified multiple indicators and behavioral patterns that defenders may want to review within their own environments.
Persistence
Registry Run Key:
|
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
Value Name:
|
CipherController |
Associated Command:
|
conhost.exe –headless powershell.exe -NoProfile -ExecutionPolicy Bypass ^ |
Files and Directories
|
C:\Users\<user>\AppData\Local\Temp\tmp3080.ps1 C:\Users\<user>\AppData\Local\CipherController\ C:\Users\<user>\AppData\Local\CipherController\runtime\node.exe C:\Users\<user>\AppData\Local\CipherController\runtime\tor\tor\tor.exe |
Behavioral Indicators
Individually, none of these indicators are necessarily malicious. Together, however, they formed the signal that ultimately led to discovery of a sophisticated fileless RAT designed to remain hidden behind legitimate software, encrypted communications, and anonymous infrastructure.
The Difference Between Detection and Hunting
Many organizations focus on alerts. Threat hunters focus on questions.
An alert may tell you something happened. A threat hunter wants to know why.
Those questions transformed a single behavioral detection into a comprehensive understanding of the threat.
Without human investigation, the original signal might have remained exactly what it appeared to be: a strange event buried inside an overwhelming amount of noise.
Threat hunting is the process of turning those signals into intelligence.
Every Investigation Makes Every Detection Better
One of the most valuable outcomes of threat hunting is that investigations do not end when a case closes.
Every investigation improves future defenses. Every newly observed behavior becomes an opportunity to create stronger detections. Every discovery strengthens the defensive ecosystem protecting customers.
The findings from this investigation are no different. Techniques uncovered during the hunt informed additional detection engineering efforts, allowing the RSM Defense Threat Hunting Team to continuously improve visibility into emerging attacker tradecraft.
|
The RSM Defense cycle Threat Intelligence -> Threat Hunting -> Detection Engineering -> Protection |
The result is a constantly evolving detection library built from real-world attacker behavior rather than theoretical scenarios.
Why This Matters
The most dangerous threats are rarely the loudest. They are often the ones specifically engineered not to be seen.
They hide behind legitimate software. They blend into normal activity. They evade traditional signatures. They exploit assumptions.
Finding those threats requires more than technology alone. It requires defenders who understand attacker behavior, challenge assumptions, and recognize the signal hidden within overwhelming amounts of noise.
It requires threat hunting.
The sophisticated fileless RAT uncovered during this investigation serves as a reminder that the most effective detections are often not the ones looking for known malware. They are the ones looking for behavior that simply does not belong.
And sometimes, that single signal is enough to expose an entire attack chain.
About the RSM Defense Threat Hunting Team
The RSM Defense Threat Hunting Team conducts ongoing hypothesis-driven investigations across customer environments to identify emerging threats, uncover previously unknown attacker activity, and transform those findings into actionable defensive capabilities.
Today, the team maintains a library of more than 300 custom detections developed from real-world attacker behaviors observed during hunts and investigations.
|
Final thought Sometimes the most important threats are the ones nobody else is looking for. |
