PHANTOMPULSE RAT Uses Process Injection, UAC Bypass to Compromise Windows Systems

Key Takeaways

• PHANTOMPULSE is a newly identified remote access trojan (RAT) actively targeting the cryptocurrency sector.
• The malware employs sophisticated evasion techniques, including multiple process injection methods and a User Account Control (UAC) bypass.
• Its unique command-and-control (C2) mechanism leverages blockchain transactions, presenting a novel sinkholing opportunity for defenders.
• Attribution points to North Korean threat groups such as Lazarus, BlueNoroff, and UNC5342 (Contagious Interview).

A newly discovered remote access trojan (RAT), dubbed PHANTOMPULSE, is alarming cybersecurity researchers due to its sophisticated methods for compromising Windows systems. This advanced malware serves as the final payload in a larger attack framework known as REF6598, which has been observed actively targeting organizations within the cryptocurrency industry.

PHANTOMPULSE stands out for its intricate chaining of advanced techniques designed to bypass conventional security measures, according to a detailed analysis by Elastic Security Labs.

Initial Infection and Payload Delivery

The attack chain begins with victims being lured through malicious Obsidian plugins. Obsidian, a knowledge management tool, is popular among developers and researchers, making its abuse a potent initial vector. Once an initial foothold is established, an in-memory loader, referred to as PHANTOMPULL, deploys the PHANTOMPULSE implant onto the compromised machine.

Upon successful deployment, the RAT takes control, establishing persistence, actively evading detection, and opening a covert communication channel back to its operators.

Elastic Security Labs analysts provided a comprehensive reverse-engineering report on PHANTOMPULSE, detailing its various components and functionalities.

The Elastic Security Labs report highlights that the implant incorporates three distinct process injection techniques, utilizes a blockchain-based command-and-control (C2) channel, and features a UAC bypass mechanism that quietly escalates privileges without triggering typical security alerts.

Intriguingly, the malware exhibits characteristics suggestive of AI-assisted development, evidenced by its unusually verbose and meticulously structured internal debug strings. This suggests a well-resourced and advanced development effort behind the threat.

Attribution to North Korean Threat Actors

The tactics, techniques, and procedures (TTPs) associated with the PHANTOMPULSE threat cluster strongly align with those of known North Korean-linked groups, including Lazarus, BlueNoroff, and UNC5342 (also known as Contagious Interview).

Key indicators such as the malware’s specific focus on cryptocurrency wallets, its capability for cross-platform targeting across Windows and macOS environments, and the use of Telegram as a fallback communication channel are all consistent with the operational patterns of these North Korean clusters.

These collective signals strongly suggest the involvement of a mature and well-funded threat actor operating across various regional markets.

PHANTOMPULSE RAT Uses Process Injection and UAC Bypass

PHANTOMPULSE is equipped with three distinct injection methods, each tailored for a specific payload type to maximize stealth and effectiveness.

Process Injection Techniques

For shellcode injection, the malware utilizes a technique named PhantomInject. This method involves overwriting a legitimate Windows DLL, specifically dbghelp.dll, instead of allocating new executable memory. This tactic makes the injected thread appear to reside within a trusted Windows file, thereby enhancing its ability to evade memory scanners and other security tools.

When deploying executable payloads, PHANTOMPULSE employs DbgNexum, a technique reportedly derived from a publicly available proof-of-concept published on GitHub in January 2026. This method executes code by leveraging the Windows Debug API, processing one exception at a time. Crucially, this approach eliminates the need for direct memory writes to the target process, further complicating detection.

DLL payloads are handled via a full manual mapping routine. This process strips Portable Executable (PE) headers from memory, effectively removing common forensic artifacts that security analysts might use for identification.

UAC Bypass Mechanism

The UAC bypass functionality within PHANTOMPULSE exploits a known technique, cataloged as UACME issue #129. This method leverages a specific Windows COM interface that grants non-administrative callers an elevated instance. The implant then utilizes this elevated access to register a high-privilege scheduled task, allowing it to relaunch itself with full administrator rights.

Should the primary UAC bypass method fail, PHANTOMPULSE includes a fallback mechanism. It spawns a rundll32 proxy process to attempt privilege escalation again, using several different registration variants to increase its chances of success.

Blockchain-Based C2 and Sinkhole Opportunity

One of the most innovative and unusual features of PHANTOMPULSE is its method for locating its command-and-control (C2) server. Instead of relying on conventional hardcoded domains or fast-flux DNS, the malware retrieves the C2 URL from the input field of the latest transaction originating from a specific cryptocurrency wallet. This process spans three distinct blockchain networks: Ethereum, Base, and Optimism.

The retrieved URL is XOR-encrypted, with the cryptocurrency wallet address serving as the decryption key. If the blockchain-based resolution fails, the implant reverts to a hardcoded panel domain for its C2 communication.

From a defensive standpoint, this blockchain C2 mechanism presents a unique opportunity: the resolver lacks any sender verification. This means any party capable of posting a transaction to the designated wallet with their own XOR-encoded URL can effectively redirect all polling PHANTOMPULSE instances to their server.

Elastic researchers highlighted that a single, well-placed blockchain transaction could theoretically sinkhole an entire PHANTOMPULSE campaign. This represents a potentially viable and low-cost option for network defenders to disrupt the malware’s operations.

What You Should Do

Organizations, particularly those in the cryptocurrency sector, must implement robust defensive measures against PHANTOMPULSE. Practical mitigation steps include:

• Monitor Scheduled Tasks: Proactively scrutinize for any suspicious scheduled tasks, especially those configured to run under the Microsoft Windows .NET Framework path.
• Detect Unusual rundll32.exe Activity: Monitor for instances of rundll32.exe executing with unusual or unexpected arguments. Such activity could indicate malicious process injection or privilege escalation attempts.
• Guard Against API Tampering: Implement detections for hardware breakpoint-based tampering with Windows security APIs. This can signal attempts by malware to evade security controls.
• Utilize YARA Rules: Integrate Elastic Security Labs’ YARA detection rules, identified as Windows.Trojan.PhantomPulse, into your threat hunting and endpoint detection systems.
• Review Obsidian Plugin Usage: Educate users about the risks of installing unverified Obsidian plugins and implement policies to restrict their use to trusted sources.
• Enhanced Network Monitoring: Monitor network traffic for connections to the identified C2 domains and IP addresses, including the blockchain provider domains (th.blockscout.com, base.blockscout.com, optimism.blockscout.com) for unusual patterns.

Indicators of Compromise (IoCs):

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.