Redundant by Design: Dissecting a Multi-RAT Phishing Campaign Targeting Canadian Businesses 

Key Takeaways

• Blackpoint’s Adversary Pursuit Group (APG) identified a phishing campaign targeting Canadian organizations that used a single delivery framework to deploy DCRat, Violet RAT, PureRAT, and AnyDesk.  
• The campaign was built around redundant access, giving the operator several independent ways to maintain control of a compromised host if one access method failed or was blocked.  
• A central orchestration layer managed persistence, updates, security checks, payload delivery, and connection validation across the different malware branches.  
• The delivery framework gave the operator flexibility to change payloads and execution paths without rebuilding the initial phishing chain.  
• Exposed campaign material provided visibility into the operator’s intended targeting, though inclusion on the target list does not confirm that an organization was successfully compromised. 
• Blackpoint has detections in place across the campaign’s execution chain and uses Application Control to block unauthorized AnyDesk activity, limiting both malware execution and fallback remote access. 
• For MSPs, this campaign matters because successful compromise can lead to persistent remote access, credential theft, lateral movement, data theft, and follow-on ransomware deployment. In a managed environment, that access can also create a path from a single compromised endpoint into broader customer infrastructure, increasing the potential scope and business impact of the intrusion. 
• This campaign demonstrates how modular intrusion frameworks and redundant access mechanisms allow attackers to adapt their operations and maintain control even when individual malware payloads or C2 connections are disrupted.

Executive Summary

Blackpoint’s Adversary Pursuit Group (APG) investigated a phishing campaign targeting Canadian organizations after an operational security error exposed malware, infrastructure, and a list of intended targets. While the exposed material does not establish that every listed organization was compromised, it provided a rare look into how the campaign was structured and operated. 

The infection chain used a document themed lure to move victims into attacker controlled staging infrastructure, where a central orchestration layer established persistence and managed the rest of the infection. Rather than delivering a single payload, the framework could adapt execution based on the host, retrieve additional tooling, retry failed connections, and maintain the infection over time. 

Behind that framework, APG identified DCRat, Violet RAT, and PureRAT, along with AnyDesk as an additional remote access channel. Each provided the operator with a separate path for maintaining control, creating redundancy across both custom malware and legitimate remote administration software. 

What makes this campaign stand out is not the use of any single RAT, but the vibe-coded orchestration layer built around them. The operator assembled a modular intrusion framework that can swap payloads, change execution paths, retry failed access, and fall back to alternate remote-control channels without rebuilding the campaign. That approach turns commodity malware and native tooling into a reusable platform, making the shared delivery and orchestration framework the most durable capability for defenders to track. 

Built to Persist

This campaign reflects a broader shift toward modular intrusion frameworks that allow operators to combine existing malware, legitimate remote access tools, and native scripting into adaptable operations. The deployment of three independent RATs alongside AnyDesk suggests that maintaining access is a central priority, with multiple fallback mechanisms available if individual components are detected or disrupted. The orchestration layer is particularly significant because it allows the operator to modify payloads and execution paths without rebuilding the initial delivery chain, reducing the effort required to maintain the operation over time. 

These factors make shared delivery and orchestration framework a more consistent target for tracking than the individual malware families or C2 infrastructure, which can be replaced independently. For defenders, understanding how these components work together is essential to identifying the full scope of an intrusion and ensuring that removing one access mechanism does not leave others intact. 

Technical Analysis 

From Invoice to WebDAV

The analyzed lure masquerades as a telecommunications invoice and directs the recipient to download a ZIP archive from remote infrastructure. Inside the archive, Rechnung Nr. 2026-50917.pdf.url is presented as a legitimate invoice document but is actually a Windows Internet Shortcut (.url) file. 

When opened, the shortcut does not launch a local PDF. Instead, it uses Windows WebDAV syntax to retrieve a remote get.wsh configuration file, moving execution from the delivered lure into the next stage of the infection chain. From there, additional components can be retrieved and staged remotely. 

Figure 1: Internet Shortcut used to retrieve the remote WSH stage

The retrieved WSH configuration references the path \104.219.236[.]184[@]8080\get.js, which points to the JavaScript responsible for delivering the next stage. Once executed, get.js copies several campaign components into the victim’s Downloads directory, including wupd.dll, as.dll, ab.dll, g.bat, and a decoy invoice. 

Figure 2: JavaScript staging and payload execution logic 

The JavaScript then launches g.bat with the arguments general x while suppressing the visible command window. This allows the infection chain to continue with minimal user interaction while reducing the likelihood that the victim notices the additional execution activity. 

By keeping the initial lure lightweight and hosting the core staging logic remotely, the threat actor separates the delivery mechanism from the downstream payloads. This design gives the operator greater flexibility to modify JavaScript, replace payloads, or alter execution logic without needing to redistribute the original lure. 

The Orchestrator in the Middle

Once g.bat executes, the infection chain moves out of the victim’s Downloads directory and establishes persistence under the user profile. The script copies itself to %LOCALAPPDATA%\Microsoft\WindowsUpdate\wupd.bat, writes wupd_h.vbs as a hidden launcher, creates a Startup folder entry, and registers the scheduled task wupd_chk to execute every 30 minutes. These persistence mechanisms give the malware multiple opportunities to regain execution after logon or during subsequent task cycles. 

Figure 3: Persistence established by the batch loader 

The batch script also serves as its own update mechanism. During each execution cycle, g.bat can retrieve a fresh copy of itself from 104.219.236[.]184:8080, compare the remote file size against the locally persisted version, replace the existing copy when needed, and relaunch the updated script. The malware also sends status callbacks to port 8888, reporting milestones such as persistence establishment, payload retrieval, Python runtime setup, and whether a Command and Control (C2) session was successfully created. 

Figure 4: Self Update functionality implemented by g.bat 

Downstream execution changes based on the local security environment. g.bat enumerates running processes and checks for products associated with ESET, Kaspersky, AVG, Avira, and Avast. Systems that do not match these checks follow a PowerShell based execution path using hidden loaders.  

Figure 5: Environment aware payload execution 

If one of the monitored third-party security products is present, the script can deploy an embedded Python runtime and execute the 64-bit AS branch through w.py, while the 32-bit AB branch continues to use SysWOW64 PowerShell. This branching logic allows the malware to alter its execution path based on the defensive tooling present on the host. 

Figure 6: PowerShell based payload execution path

Figure 7: Python based payload execution path 

Three RATs, Three Backends

Analysis of the staged payloads showed that the campaign deploys three distinct RAT families rather than multiple wrappers around a single implant. The orchestration logic reflects that separation by checking for established sessions to three separate C2 endpoints before determining whether any payloads need to be relaunched. 

Branch	Family	C2
AB / ab.xor	DCRat	212.227.50[.]164:3232
AS / as.xor	Violet RAT	91.219.239[.]10:4452
WUPD / Vypds	PureRAT	vamil1.duckdns[.]org:56001-56003

The AB branch decrypts into DCRat and carries 212.227.50[.]164:3232 in its configuration. The AS branch produces a .NET payload that identifies itself as Violet v6. Executing the carved payload in a controlled analysis environment produced a direct callout to 91.219.239[.]10:4452, confirming that endpoint as the Violet RAT backend used by this campaign. 

The third branch is more layered. wupd.dll decrypts a large position independent payload in memory, and the recovered Vypds chain ultimately yields a protected 32-bit .NET RAT. Breaking its string resolver exposed the family version, configuration, collection targets, and transport behavior, which identified the payload as PureRAT 4.4.3. 

Following the PureRAT Branch

The PureRAT branch initially presents itself as a generic encrypted loader. wupd.dll dynamically resolves Windows CNG functions from bcrypt.dll and uses AES-ECB as the underlying primitive for a manually implemented CTR style decryption routine. The loader decrypts a 477,442-byte shellcode buffer in memory, changes the allocated region from writable to executable, and transfers execution directly into the recovered payload. 

The subsequent Vypds container introduces another layer of protection. Its contents are decrypted with TripleDES-CBC and then decompressed with GZip, producing a .NET DLL that obscures operational strings behind a Babel-style resource layer and a dynamically generated Hashtable resolver. APG recovered all 152 direct resolver call sites and mapped them to 138 plaintext values, exposing the malware version, persistence commands, WMI queries, browser data paths, cryptocurrency wallet targets, and the embedded configuration. These recovered artifacts identify the payload as PureRAT 4.4.3. 

The decoded configuration references vamil1.duckdns[.]org and ports 56001, 56002, and 56003. It also contains an embedded X.509 certificate, the group value Default, the installation token APPDATA, and a setting used to prevent the host from entering sleep. 

Figure 8: Decrypted PureRat configuration fields 

After establishing a connection, the client wraps the underlying socket in SslStream, transmits host information, and enters a receive loop that processes four-byte length prefixed messages. Received commands are dispatched onto worker threads for asynchronous execution, providing the core tasking mechanism for the RAT. 

A Fourth Door With AnyDesk

The campaign does not rely solely on its three RAT families for remote access. APG also identified a separate VBS based installer that deploys AnyDesk, providing the operator with an additional interactive access channel outside the DCRat, Violet RAT, and PureRAT communication paths. 

This adds an important containment consideration. A host that no longer communicates with the identified RAT infrastructure may still remain accessible through AnyDesk. Using multiple malware families alongside a legitimate remote administration tool gives the operator several ways to maintain access without depending on a single C2 channel. 

Figure 9: Deobfuscated AnyDesk Downloader 

Conclusion

The most important finding in this campaign is not any single RAT. It is the framework that connects the entire intrusion. A document lure leads to a WebDAV stager, a persistent batch controller manages execution, and several remote access tools sit behind the same delivery chain. 

That design gives the operator flexibility without requiring the campaign to be rebuilt each time something changes. The batch controller can update itself, adjust execution based on the endpoint environment, retry failed launches, and support multiple C2 backends. AnyDesk adds another access path that does not depend on the custom malware. 

The campaign also shows why vibe coding matters for modern threat activity. Operators no longer need to build every component from scratch. Existing RATs, native Windows tools, scripts, persistence methods, and fallback logic can be assembled into a functional framework much faster than before. While the code alone does not prove that AI was used to create these components, this type of modular development is becoming easier to produce, modify, and maintain with modern coding assistants. 

APG identified three malware families operating within the same delivery framework. DCRat, Violet RAT, and PureRAT 4.4.3 each used separate backend infrastructure, reinforcing that the campaign was designed to support multiple independent remote access paths. 

How Blackpoint Reduces Exposure to This Campaign 

Blackpoint already detects activity across the campaign’s execution chain, providing visibility into the behaviors used to stage and launch these payloads. Blackpoint’s Application Control also blocks unauthorized AnyDesk execution, cutting off the operator’s fallback remote access channel. 

The individual payloads are replaceable. The durable capability is the delivery and orchestration framework that allows the operator to swap malware, rotate infrastructure, and maintain access without rebuilding the campaign from the ground up. Blackpoint’s coverage is designed around that reality by targeting the repeatable behaviors that remain consistent even as the underlying tools change. 

Preventive Controls for Managed Environments 

• Reduce exposure to script based delivery. Block or restrict internet delivered .url, .wsh, .js, and similar script based file types where they are not required, especially when delivered through email or downloaded archives. 

• Restrict outbound WebDAV. Disable or tightly control WebDAV access to untrusted internet infrastructure to prevent remote content retrieval through UNC style paths and @SSL syntax. 

• Harden PowerShell and scripting environments. Enforce PowerShell logging, Constrained Language Mode where practical, and application control policies that prevent PowerShell, WScript, CScript, and Python from launching from user writable directories. 

• Block unauthorized remote access tools. Use Blackpoint’s Application Control to prevent unauthorized AnyDesk execution while allowing approved remote administration software where business use is required. 

• Limit persistence opportunities. Apply application control and least privilege policies that prevent users from creating unauthorized scheduled tasks, Startup folder launchers, and executable content under %LOCALAPPDATA%. 

• Treat confirmed activity as a full compromise. Isolate affected systems, remove all persistence and remote access mechanisms, reset exposed credentials, and validate the environment before returning the host to service. 

Indicators of Compromise

Network Indicators

Type	Indicator	Context
IP:Port	212.227.50[.]164:3232	DCRat C2
IP:Port	91.219.239[.]10:4452	Violet RAT C2
Domain:Port	vamil1.duckdns[.]org:56001-56003	PureRat C2
IP:Port	148.113.137[.]1:56001	PureRat C2
IP:Port	104.219.236[.]184:8080	Script and payload staging
IP:Port	104.219.236[.]184:8888	Campaign status and staging callbacks
Domain	dav.zm.tudgzyx[.]com	WebDAV lure and ZIP staging
Domain	zm.tudgzyx[.]com	Campaign lure infrastructure
Domain	mpo007-rtplive[.]com	Campaign lure infrastructure

Host and File Indicators

Type	Indicator	SHA-256	Context
File	Telekom_Rechnung_RE-50917.pdf	1ed6244867f40ef0bcfac6f03647205841e7ac88a8329280e791c2595d47b664	Invoice lure
File	RE-50917.zip	5f5b2b2f829509d7f309b03c1d1a3c2dc1d0d0aa9b6490624429bb42f623aaf6	WebDAV hosted archive
File	Rechnung Nr. 2026-50917.pdf.url	bcf2d5d527d8ad644589790438d53b21ae20a0263e1f1da5b8c1b97aa3bc2888	Internet Shortcut
File	get.js	c27c1438954cc94032d8a6829944f5bceb795458b6482c926825e83e5c64604a	JavaScript stager
File	g.bat	6abc523c2f17a59f2ba224f0933ceb9b1427080913a0370daeb8859be0d32ef9	Campaign orchestrator
File	wupd.dll	a60d5ed2190342fe5730e97a6e775e08fb814b32be9ce71cd38c689929eee481	WUPD encrypted loader
File	as.dll	f1677e9606656039be530c5eacdce08144ec3192e54152bdeab748ec0609d6d8	AS branch loader
File	ab.dll	bf9414d6454f7b5ccfe75e83df27f61fbcdd16396946d2dca5626c815ce6b335	AB branch loader
File	VioletRAT payload	fbd40ec2a07004e1b9cb851867adf7101c55ab7c957e8707e5f08182b31c21ef	Violet RAT
File	DCRat payload	e44ee5ed34aaef7e921d178d84017b74062f1d9ff811faff149046f0f5ae2187	DCRat 3.6.0.0
File	PureRat payload	432fbc1738f8e2051c37d0622969104310277cf9a4a6894bb7177a58ba85f253	PureRAT 4.4.3 final .NET stage

URL Indicators

Indicator	Context
hxxps[://]dav[.]zm[.]tudgzyx[.]com/DavWWWRoot/RE-50917[.]zip	WebDAV hosted ZIP referenced by analyzed lure
hxxps[://]mpo007-rtplive[.]com/dl[.]php?s=general_ca&h=T3stHQv702	Campaign lure URL
hxxps[://]zm[.]tudgzyx[.]com/dl[.]php?s=general	Campaign lure URL
file://\\dav[.]zm[.]tudgzyx[.]com@SSL\DavWWWRoot\get[.]wsh	Remote WSH path referenced by the Internet Shortcut