Crimson RAT

Aliases: SEEDOOR, Scarimson

First seen
2017-01-01 00:00:00
Malware type
rat, spyware
Family
Malware family
Last IoC activity
2026-07-22 04:03:53
Profile updated
2026-07-07 12:38:33

Targeted industries: government-and-public-sector technology-and-telecommunications

Context

It was first discovered in 2017 and has since been used to attack organizations around the world. The malware is often distributed through phishing emails or by exploiting vulnerabilities in outdated security software. Once Crimson RAT is installed on a computer, it can be used to steal data, spy on users, and even take control of the infected computers. Some of the features of Crimson RAT include: Remote control of infected computers Data theft, such as passwords, files, and emails User spying Takeover of infected computers Locking of infected computers Extortion of payments

Exploited vulnerabilities

  • CVE-2023-38831 (vulnerability)

Related threat objects

Reports & references

  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • proofpoint.com — Proofpoint Operation Transparent Tribe Threat Insight En (report)
  • s.tencent.com — 669 (report)
  • secureworks.com — Copper Fieldstone (report)
  • Trend Micro — Investigating Apt36 Or Earth Karkaddans Attack Chain And Malware (report)
  • Microsoft — Frequent Freeloader Part I Secret Blizzard Compromising Storm 0156 Infrastructure For Espionage (report)
  • pwc.co.uk — Cyber Threats 2019 Retrospect (report)
  • Cisco Talos — Transparent Tribe Infra And Targeting (report)
  • Kaspersky — 98127 (report)
  • Kaspersky — 98233 (report)
  • secrss.com — 24995 (report)
  • mp.weixin.qq.com — Ahxp5Hmrotmsfbiuxj0Cfg (report)
  • amnesty.org — Asa3383662018English (report)
  • brandefense.io — Apt 36 Campaign Poseidon Malware Technical Analysis (report)
  • Kaspersky — 99204 (report)
  • proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
  • blog.cluster25.duskrise.com — Cve 2023 38831 Russian Attack (report)
  • zscaler.com — Catching Rats Over Custom Protocols (report)
  • seqrite.com — Pakistani Apts Escalate Attacks On Indian Gov Seqrite Labs Unveils Threats And Connections (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Crimson (report)
  • Trend Micro — Earth%20Karkaddan%20Apt %20Adversary%20Intelligence%20And%20Monitoring%20Report (report)
  • mp.weixin.qq.com — Xum2X89Gub8Up6Otn612Fg (report)
  • blog.lumen.com — Snowblind The Invisible Hand Of Secret Blizzard (report)
  • twitter.com — 1502206599166939137 (report)
  • twitter.com — 1351228309632385027 (report)

External references