{"id":75106,"date":"2018-02-02T17:38:21","date_gmt":"2018-02-03T01:38:21","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=75106"},"modified":"2018-02-05T08:06:40","modified_gmt":"2018-02-05T16:06:40","slug":"new-crossrat-malware-used-in-global-cyber-espionage-campaign","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/","title":{"rendered":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-75250\" src=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2018\/01\/CrossRAT-Java-Malware.jpeg\" alt=\"CrossRAT Malware Used in Global Cyber-Espionage Campaign\" width=\"600\" height=\"300\" srcset=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2018\/01\/CrossRAT-Java-Malware.jpeg 600w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2018\/01\/CrossRAT-Java-Malware-150x75.jpeg 150w, https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2018\/01\/CrossRAT-Java-Malware-300x150.jpeg 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/p>\n<p>Researchers from the Electronic Frontier Foundation (EFF) and Lookout have\u00a0published a <a href=\"https:\/\/info.lookout.com\/rs\/051-ESQ-475\/images\/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf\" target=\"_blank\">security research\u00a0report<\/a>\u00a0analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &#8220;Dark Caracal Cyber-espionage at a Global Scale&#8221;\u00a0is detailed and makes for a good read. In it are details\u00a0about\u00a0a new piece of cross-platform malware, named CrossRAT, detected by\u00a0<a href=\"https:\/\/www.intego.com\/antivirus-mac-internet-security\">Intego VirusBarrier<\/a>\u00a0as <strong>Java\/LaunchAgent<\/strong>.<\/p>\n<p>CrossRAT is a Java-based backdoor that can be deployed on Windows, Linux and macOS systems and will be the focus of this article. Here&#8217;s what we currently know about this new CrossRAT malware and what you can do to protect yourself.<\/p>\n<h3>How does CrossRAT malware install?<\/h3>\n<p>CrossRAT likely ends up on victim&#8217;s systems through <a href=\"https:\/\/www.intego.com\/mac-security-blog\/social-hacking\/\" target=\"_blank\">social engineering<\/a>, phishing, and in some cases physical access. The use of Facebook groups and WhatsApp messages are\u00a0mentioned in the report as well as spear-phishing. It is unknown if fake or infected installers such as Flash Player were used. CrossRAT is Java based, and so infection through a web browser is likely the most common\u00a0way cybercriminals infect a target.<\/p>\n<p>Once the malicious file (<span class=\"main-article-info\"><i>hmar6.jar<\/i><\/span>) is successfully loaded on a target system, it checks the version of the operating system and installs the appropriate means to keep itself alive. The malware\u00a0then checks in with a\u00a0Command and Control (C&amp;C) server, receives instructions and gets to work. The C&amp;C server is known to be <span class=\"n3rdFont\">flexberry[.]com<\/span> and CrossRAT communicates with it on port <span class=\"n3rdFont\">2223.<\/span><\/p>\n<p>Persistence is achieved by installing a LaunchAgent that links to a file placed in the user&#8217;s Library folder.<\/p>\n<h3>What can CrossRAT do?<\/h3>\n<p>When CrossRAT first reaches out to the C&amp;C server, it transmits several pieces of information:<\/p>\n<ul>\n<li>Operating System name<\/li>\n<li>Operating System version<\/li>\n<li>Host name<\/li>\n<li>User name<\/li>\n<\/ul>\n<p>If CrossRAT finds instructions, it will get to work right away. These instructions can be any of the following:<\/p>\n<ul>\n<li>Enumerate root directories on the system<\/li>\n<li>Enumerate files on the system<\/li>\n<li>Create blank file on system<\/li>\n<li>Copy File<\/li>\n<li>Move file<\/li>\n<li>Write file contents<\/li>\n<li>Read file contents<\/li>\n<li>Heartbeat request<\/li>\n<li>Get screenshot<\/li>\n<\/ul>\n<p>A keylogger module appears to be included in CrossRAT, but it is not active. As CrossRAT&#8217;s version lists 0.1, the keylogger and other functionality may simply be activated in future versions.<\/p>\n<p>These commands are enough to exfiltrate all kinds of sensitive data from a system and give the attacker complete control.<\/p>\n<h3>Should Mac users be concerned about CrossRAT?<\/h3>\n<p>Security researcher, Patrick Wardle, noted the following in his analysis of CrossRAT:<\/p>\n<blockquote><p>As CrossRAT is written in Java, it requires Java to be installed. Luckily recent versions of macOS do <i>not<\/i> ship with Java. Thus, most macOS users should be safe! Of course if a Mac user already has Java installed, or the attacker is able to coerce a naive user to install Java first, CrossRAT will run just dandy, even on the latest version of macOS (High Sierra).<\/p><\/blockquote>\n<p>With web browsers either actively blocking Java from automatically running or providing an option to block Java, user risk is reduced. That said, spear-phishing or phishing campaigns can be very effective, so a target can be tricked to\u00a0enable Java or, as Patrick mentioned, install it.<\/p>\n<h3>How to tell if your Mac is infected (and removal instructions)<\/h3>\n<p>To check if your Mac is infected and to clear the infection if present, browse to the following folders and trash the following files:<\/p>\n<ul>\n<li><strong>~ Library<\/strong>\u00a0\u2192 Look for a file named <strong><span class=\"n3rdFont\">mediamgrs.jar<\/span> <\/strong>&#8211; Delete this file (if found).<\/li>\n<li><strong>~ Library<\/strong> &gt; <strong>LaunchAgents<\/strong> &gt;<strong> <span class=\"n3rdFont\">mediamgrs.plist<\/span><\/strong> &#8211; Delete this file.<\/li>\n<li><strong>~ Library<\/strong> &gt; <strong>LaunchAgents<\/strong> &gt;<strong> <span class=\"n3rdFont\">mediamgrs.plist <\/span><\/strong><span class=\"n3rdFont\">&#8211; Delete this file.<\/span><\/li>\n<\/ul>\n<p>If an infection is found and the above files have been deleted, empty your trash and restart your Mac. This will effectively remove the malware from your Mac.<\/p>\n<h3>How to protect yourself from CrossRAT<\/h3>\n<p><a href=\"https:\/\/www.intego.com\/antivirus-mac-internet-security\">Intego VirusBarrier<\/a> users are protected from CrossRAT, detected as Java\/LaunchAgent.<\/p>\n<p>Intego&#8217;s Mac anti-virus will remove it from an infected system or block it from installing if the malware\u00a0makes its way onto your Mac in the future. Of course, using a two-way firewall solution, such as Intego NetBarrier, will also alert you of any connection attempts to\u00a0and from applications, which allows you to spot suspect behavior.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Researchers from the Electronic Frontier Foundation (EFF) and Lookout have\u00a0published a security research\u00a0report\u00a0analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &#8220;Dark Caracal Cyber-espionage at a Global Scale&#8221;\u00a0is detailed and makes for a good read. In it are details\u00a0about\u00a0a new piece of cross-platform malware, named CrossRAT, detected by\u00a0Intego VirusBarrier\u00a0as Java\/LaunchAgent. CrossRAT is [&hellip;]<\/p>\n","protected":false},"author":79,"featured_media":8763,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190],"tags":[3907,75,3904,3175],"class_list":["post-75106","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","tag-crossrat","tag-java","tag-javalaunchagent","tag-macos"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &quot;Dark Caracal Cyber-espionage at a Global Scale&quot; is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Jay Vrijenhoek\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"The Mac Security Blog - Keep Macs safe from the dangers of the Internet\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\" \/>\n\t\t<meta property=\"og:description\" content=\"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &quot;Dark Caracal Cyber-espionage at a Global Scale&quot; is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2018-02-03T01:38:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2018-02-05T16:06:40+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/integogroup\/\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@IntegoSecurity\" \/>\n\t\t<meta name=\"twitter:title\" content=\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &quot;Dark Caracal Cyber-espionage at a Global Scale&quot; is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@IntegoSecurity\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#blogposting\",\"name\":\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\",\"headline\":\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\",\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/jay-vrijenhoek\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert-intego.jpg\",\"width\":400,\"height\":260,\"caption\":\"Malware Alert from Intego\"},\"datePublished\":\"2018-02-02T17:38:21-08:00\",\"dateModified\":\"2018-02-05T08:06:40-08:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#webpage\"},\"articleSection\":\"Malware, CrossRAT, Java, Java\\\/LaunchAgent, macOS, Jay Vrijenhoek\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"name\":\"Malware\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"position\":2,\"name\":\"Malware\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#listItem\",\"name\":\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#listItem\",\"position\":3,\"name\":\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/category\\\/malware\\\/#listItem\",\"name\":\"Malware\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/logo2.png\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#organizationLogo\",\"width\":122,\"height\":46},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/integogroup\\\/\",\"https:\\\/\\\/x.com\\\/IntegoSecurity\",\"https:\\\/\\\/www.instagram.com\\\/intego_security\\\/\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/IntegoVideo\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/intego\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/jay-vrijenhoek\\\/#author\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/jay-vrijenhoek\\\/\",\"name\":\"Jay Vrijenhoek\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/0a71de1f5ddc5a07a2f0f031303f990a61ae1b27da8a22e370997a44ebfe51f5?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Jay Vrijenhoek\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#webpage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/\",\"name\":\"New CrossRAT Malware Used in Global Cyber-Espionage Campaign\",\"description\":\"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, \\\"Dark Caracal Cyber-espionage at a Global Scale\\\" is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\\\/LaunchAgent. CrossRAT is\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/jay-vrijenhoek\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/jay-vrijenhoek\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2012\\\/12\\\/MalwareAlert-intego.jpg\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#mainImage\",\"width\":400,\"height\":260,\"caption\":\"Malware Alert from Intego\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\\\/#mainImage\"},\"datePublished\":\"2018-02-02T17:38:21-08:00\",\"dateModified\":\"2018-02-05T08:06:40-08:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>New CrossRAT Malware Used in Global Cyber-Espionage Campaign<\/title>\n\n","aioseo_head_json":{"title":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","description":"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, \"Dark Caracal Cyber-espionage at a Global Scale\" is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is","canonical_url":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#blogposting","name":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","headline":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/jay-vrijenhoek\/#author"},"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert-intego.jpg","width":400,"height":260,"caption":"Malware Alert from Intego"},"datePublished":"2018-02-02T17:38:21-08:00","dateModified":"2018-02-05T08:06:40-08:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#webpage"},"isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#webpage"},"articleSection":"Malware, CrossRAT, Java, Java\/LaunchAgent, macOS, Jay Vrijenhoek"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","name":"Malware"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","position":2,"name":"Malware","item":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#listItem","name":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#listItem","position":3,"name":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","previousItem":{"@type":"ListItem","@id":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/#listItem","name":"Malware"}}]},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2026\/08\/logo2.png","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#organizationLogo","width":122,"height":46},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/integogroup\/","https:\/\/x.com\/IntegoSecurity","https:\/\/www.instagram.com\/intego_security\/","https:\/\/www.youtube.com\/user\/IntegoVideo","https:\/\/www.linkedin.com\/company\/intego"]},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/jay-vrijenhoek\/#author","url":"https:\/\/www.intego.com\/mac-security-blog\/author\/jay-vrijenhoek\/","name":"Jay Vrijenhoek","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/0a71de1f5ddc5a07a2f0f031303f990a61ae1b27da8a22e370997a44ebfe51f5?s=96&d=mm&r=g","width":96,"height":96,"caption":"Jay Vrijenhoek"}},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/","name":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","description":"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, \"Dark Caracal Cyber-espionage at a Global Scale\" is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#breadcrumblist"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/jay-vrijenhoek\/#author"},"creator":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/author\/jay-vrijenhoek\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2012\/12\/MalwareAlert-intego.jpg","@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#mainImage","width":400,"height":260,"caption":"Malware Alert from Intego"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/#mainImage"},"datePublished":"2018-02-02T17:38:21-08:00","dateModified":"2018-02-05T08:06:40-08:00"},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"The Mac Security Blog - Keep Macs safe from the dangers of the Internet","og:type":"article","og:title":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","og:description":"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &quot;Dark Caracal Cyber-espionage at a Global Scale&quot; is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is","og:url":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/","article:published_time":"2018-02-03T01:38:21+00:00","article:modified_time":"2018-02-05T16:06:40+00:00","article:publisher":"https:\/\/www.facebook.com\/integogroup\/","twitter:card":"summary_large_image","twitter:site":"@IntegoSecurity","twitter:title":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","twitter:description":"Researchers from the Electronic Frontier Foundation (EFF) and Lookout have published a security research report analyzing a global government-sponsored APT group, called Dark Caracal. The report, titled, &quot;Dark Caracal Cyber-espionage at a Global Scale&quot; is detailed and makes for a good read. In it are details about a new piece of cross-platform malware, named CrossRAT, detected by Intego VirusBarrier as Java\/LaunchAgent. CrossRAT is","twitter:creator":"@IntegoSecurity"},"aioseo_meta_data":{"post_id":"75106","title":null,"description":null,"keywords":null,"keyphrases":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":null,"twitter_description":null,"schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"limit_modified_date":false,"ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":"2026-08-31 10:32:44","created":"2026-08-31 10:32:44","updated":"2026-09-04 15:03:49","reviewed_by":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/\" title=\"Malware\">Malware<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\tNew CrossRAT Malware Used in Global Cyber-Espionage Campaign\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.intego.com\/mac-security-blog"},{"label":"Malware","link":"https:\/\/www.intego.com\/mac-security-blog\/category\/malware\/"},{"label":"New CrossRAT Malware Used in Global Cyber-Espionage Campaign","link":"https:\/\/www.intego.com\/mac-security-blog\/new-crossrat-malware-used-in-global-cyber-espionage-campaign\/"}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/75106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/79"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=75106"}],"version-history":[{"count":33,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/75106\/revisions"}],"predecessor-version":[{"id":75235,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/75106\/revisions\/75235"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/8763"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=75106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=75106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=75106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}