Dan Goodin

2022-06-29 13:42:17

RuoRAT is a MIPS executable compiled for SOHO routers. It uses DNS hijacking and HTTP hijacking to infect devices connected to an infected router. The 2nd custom RAT infects Windows devices and the 3rd macOS and Linux devices. RuoRAT can also install Cobalt Strike.