HiatusRAT Malware Resurfaces: Taiwan Firms and U.S. Military Under Attack

Share:

The threat actors behind the HiatusRAT malware have returned from their hiatus with a new wave of reconnaissance and targeting activity aimed at Taiwan-based organizations and a U.S. military procurement system.

Besides recompiling malware samples for different architectures, the artifacts are said to have been hosted on new virtual private servers (VPSs), Lumen Black Lotus Labs said in a report published last week.

The cybersecurity firm described the activity cluster as “brazen” and “one of the most audacious,” indicating no signs of slowing down. The identity and the origin of the threat actors are presently unknown.

Targets included commercial firms, such as semiconductor and chemical manufacturers, and at least one municipal government organization in Taiwan as well as a U.S. Department of Defense (DoD) server associated with submitting and retrieving proposals for defense contracts.

HiatusRAT was first disclosed by the cybersecurity company in March 2023 as having targeted business-grade routers to covertly spy on victims primarily located in Latin America and Europe as part of a campaign that commenced in July 2022.

As many as 100 edge networking devices globally were infected to passively collect traffic and transform them into a proxy network of command-and-control (C2) infrastructure.

HiatusRAT Malware

The latest set of attacks, observed from mid-June through August 2023, entail the use of pre-built HiatusRAT binaries specifically designed for Arm, Intel 80386, and x86-64 architectures, alongside MIPS, MIPS64, and i386.

A telemetry analysis to determine connections made to the server hosting the malware has revealed that “over 91% of the inbound connections stemmed from Taiwan, and there appeared to be a preference for Ruckus-manufactured edge devices.”

The HiatusRAT infrastructure consists of payload and reconnaissance servers, which directly communicate with the victim networks. These servers are commandeered by Tier 1 servers, which, in turn, are operated and managed by Tier 2 servers.

The attackers have been identified as using two different IP addresses 207.246.80[.]240 and 45.63.70[.]57 to connect to the DoD server on June 13 for approximately a period of two hours. 11 MB of bi-directional data is estimated to have been transferred during the period.

It’s not clear what the end goal is, but it’s suspected that the adversary may have been looking for publicly available information related to current and future military contracts for future targeting.

The targeting of perimeter assets such as routers has become something of a pattern in recent months, with China-affiliated threat actors linked to the exploitation of security flaws in unpatched Fortinet and SonicWall appliances to establish long-term persistence within target environments.

“Despite prior disclosures of tools and capabilities, the threat actor took the most minor of steps to swap out existing payload servers and carried on with their operations, without even attempting to re-configure their C2 infrastructure,” the company said.

 

(c) The Hacker News

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
8:53 pm, Mar 10, 2025
weather icon 8°C
L: 8° | H: 9°
overcast clouds
Humidity: 78 %
Pressure: 1006 mb
Wind: 6 mph
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 6 km
Sunrise: 6:25 am
Sunset: 5:55 pm
DailyHourly
Daily ForecastHourly Forecast
Today 9:00 pm
weather icon
8° | 9°°C 0 mm 0% 9 mph 78 % 1006 mb 0 mm/h
Tomorrow 9:00 pm
weather icon
5° | 8°°C 1 mm 100% 12 mph 82 % 1009 mb 0 mm/h
Wed Mar 12 9:00 pm
weather icon
3° | 7°°C 1 mm 100% 9 mph 77 % 1007 mb 0 mm/h
Thu Mar 13 9:00 pm
weather icon
3° | 7°°C 1 mm 100% 10 mph 95 % 1006 mb 0.56 mm/h
Fri Mar 14 9:00 pm
weather icon
1° | 8°°C 0.2 mm 20% 10 mph 86 % 1015 mb 0 mm/h
Today 9:00 pm
weather icon
8° | 10°°C 0 mm 0% 9 mph 78 % 1006 mb 0 mm/h
Tomorrow 12:00 am
weather icon
8° | 8°°C 0 mm 0% 11 mph 79 % 1006 mb 0 mm/h
Tomorrow 3:00 am
weather icon
6° | 7°°C 1 mm 100% 11 mph 82 % 1007 mb 0 mm/h
Tomorrow 6:00 am
weather icon
6° | 6°°C 0.42 mm 42% 11 mph 69 % 1008 mb 0 mm/h
Tomorrow 9:00 am
weather icon
6° | 6°°C 0 mm 0% 12 mph 63 % 1009 mb 0 mm/h
Tomorrow 12:00 pm
weather icon
8° | 8°°C 0 mm 0% 11 mph 44 % 1008 mb 0 mm/h
Tomorrow 3:00 pm
weather icon
8° | 8°°C 0 mm 0% 11 mph 51 % 1007 mb 0 mm/h
Tomorrow 6:00 pm
weather icon
7° | 7°°C 0 mm 0% 8 mph 52 % 1007 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€72,578.09
-5.20%
Ethereum(ETH)
€1,708.36
-9.36%
Tether(USDT)
€0.92
-0.06%
XRP(XRP)
€1.90
-6.11%
Solana(SOL)
€108.86
-8.29%
USDC(USDC)
€0.92
0.00%
Dogecoin(DOGE)
€0.144194
-8.83%
Shiba Inu(SHIB)
€0.000011
-0.57%
Pepe(PEPE)
€0.000006
-2.92%
Scroll to Top