🎯Basically, a new malware lets hackers listen and steal your data without any security.
What Happened
A previously undocumented remote access trojan (RAT) framework named Auraboros C2 has emerged, presenting alarming vulnerabilities. It exposes victim data, enabling live surveillance and browser credential theft. The command-and-control (C2) dashboard operates over plain HTTP, lacking any form of authentication, making it accessible to anyone who can reach the server's port.
How It Works
The C2 panel, hosted on a DigitalOcean server, runs on port 5000 using an Express.js and Socket.io backend. Despite its professional appearance, it has no security controls to restrict access to its management functions or victim data. The entire JavaScript source is downloadable, revealing the framework's architecture.
Auraboros offers extensive capabilities targeting Windows systems, including:
- Screenshot capture
- Webcam snapshots
- Clipboard theft
- Live keylogging
- Wi-Fi password extraction
- Arbitrary shell command execution
- Cookie impersonation
Who's Being Targeted
The malware primarily targets Windows users, leveraging DLL sideloading to hide its presence. It uses a legitimate executable, DiskIntegrityScanner.exe, to load a malicious DLL that executes a data collection routine, making detection during routine monitoring difficult.
Signs of Infection
Indicators of infection include the presence of DiskIntegrityScanner.exe on endpoints and unusual outbound connections to port 9000 on DigitalOcean-hosted IPs. Organizations should monitor for reverse SOCKS5 activity on port 1080 as well.
How to Protect Yourself
To safeguard against Auraboros, organizations should:
- Block the IP address 174.138.43[.]25 at the network perimeter.
- Hunt for DiskIntegrityScanner.exe on all endpoints, as it is not a legitimate Windows binary.
- Set up alerts for reverse SOCKS5 activity on port 1080.
- Report the infrastructure to DigitalOcean’s abuse team.
- Monitor for Socket.io polling requests directed to non-standard ports.
Conclusion
The emergence of the Auraboros RAT highlights significant security risks associated with unprotected C2 panels. Organizations must act swiftly to mitigate potential threats and protect sensitive data from unauthorized access.
🔒 Pro insight: The use of DLL sideloading in Auraboros RAT exemplifies advanced evasion techniques, complicating detection efforts for security teams.
