New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code
A recent effort targets financial institutions, such as trading and brokerage firms, by distributing GodRAT, a remote access trojan that has not been previously identified.
In a technical study released today, Kaspersky researcher Saurabh Sharma said that the malicious activity entails the "distribution of malicious.SCR (screen saver) files disguised as financial documents via Skype messenger."
The assaults use a method known as steganography to hide the shellcode needed to download the malware from a command-and-control (C2) server within image files. They have been active as recently as August 12, 2025. Since September 9, 2024, the screen saver artifacts have been identified, focusing on nations and territories such as Hong Kong, the United Arab Emirates, Malaysia, Jordan, and Leb...