KarstoRAT RAT Enables Webcam Monitoring, Audio Recording, Remote Execution

Key Takeaways

• KarstoRAT, a sophisticated new remote access trojan (RAT), has been detected in sandbox analyses since early 2026.
• This malware grants attackers extensive control over compromised Windows systems, including webcam monitoring, audio recording, keylogging, and remote payload execution.
• The threat actors behind KarstoRAT use social engineering tactics, such as fake Roblox trading sites and game cheat panels, to distribute the malware.
• The RAT maintains persistence through multiple methods and uses a complex command-and-control (C2) infrastructure to evade detection.

A recently identified remote access trojan (RAT), dubbed KarstoRAT, has surfaced in malware repositories and sandbox analyses since early 2026. This novel threat, detailed in a recent technical report, empowers attackers with a comprehensive suite of remote control capabilities over infected Windows machines.

KarstoRAT facilitates covert webcam capture, audio recording, keylogging, and screenshot theft. Furthermore, it allows its operators to fetch and execute additional malicious payloads on demand. For a deeper dive into its technical specifics, refer to the technical report provides additional details.

From its initial execution, KarstoRAT is engineered to grant its operators complete dominion over the compromised system. The analyzed sample is a 64-bit Windows executable, compiled using Microsoft Visual Studio 2022, with a debug build timestamp of February 16, 2026.

The malware establishes communication with a hardcoded command-and-control (C2) server located at 212.227.65[.]132 on port 15144. It leverages the Windows Internet API (WinINet) for all outbound network traffic. Once active, KarstoRAT sends continuous heartbeat notifications every two seconds, ensuring a persistent link to the attacker’s server.

Stealthy Operation and Distribution

LevelBlue analysts discovered KarstoRAT during a recent threat investigation. They observed that, unlike many commodity RATs, KarstoRAT has not been publicly advertised or sold on underground forums, suggesting it may be a private tool used by a limited group of threat actors. The presence of multiple samples in public analysis environments offers a valuable opportunity for researchers to understand this emerging, private threat that has recently begun to appear in real-world attacks.

A particularly concerning aspect of KarstoRAT is its distribution method, which relies heavily on social engineering. Researchers found that the C2 infrastructure hosts deceptive websites, including a fake Roblox trading platform called “Blox Stocks” and a cheat download panel named “Venom Files.”

The “Blox Stocks” page targets young Roblox players with false promises of inexpensive in-game items. Concurrently, the “Venom Files” panel entices players of first-person shooter (FPS) and Grand Theft Auto (GTA) games with so-called “premium game cheats.” Both pages are meticulously crafted to trick unsuspecting users into downloading and executing the KarstoRAT malware.

The C2 server employs a sophisticated, multi-layered infrastructure across various open ports and services. This includes SSH tunnels, Node.js APIs, and a VMess proxy routed through Cloudflare Argo WebSocket on port 443, utilizing TLS fingerprinting set to Firefox. This intricate and obfuscated setup enables the malware to blend seamlessly with legitimate network traffic, thereby maintaining persistent access within restricted network environments.

Surveillance and Payload Execution Capabilities

Upon successful execution on a victim’s machine, KarstoRAT enters an infinite two-second polling loop, awaiting commands from its C2 server. A PEStudio analysis of the sample indicates moderate entropy with no packing applied.

The malware’s webcam module, activated by the “WEBCAM” command, initiates an invisible capture window. It connects to the default webcam driver, captures a single still frame, saves it as a temporary BMP file (webcap.bmp), and uploads it to the “/upload-webcam” endpoint before deleting the file from disk. This entire process occurs without any visible indication or alert to the victim.

The audio recording functionality utilizes the Windows Multimedia Command Interface (MCI) to silently activate the victim’s microphone. It records audio for a duration specified by the attacker, saves the output as a temporary WAV file, and uploads it to the “/upload-audio” endpoint. This recording process operates in a dedicated background thread, ensuring the main malware process remains fully responsive.

KarstoRAT’s keylogger module installs a low-level keyboard hook using SetWindowsHookExA, capturing every keystroke across all active applications. This captured data is then exfiltrated to the “/upload-keylog” endpoint via HTTP POST.

For maintaining persistence, KarstoRAT employs three distinct methods: it creates a Windows Registry Run key named “SecurityService,” establishes a Scheduled Task called “SystemCheck,” and places a copy of itself in the Windows Startup folder. Additionally, it leverages a User Account Control (UAC) bypass using fodhelper.exe to gain elevated privileges without displaying any security prompts to the victim.

What You Should Do

• Immediately block the KarstoRAT C2 IP address 212.227.65[.]132 at the network perimeter.
• Monitor network logs for connections on ports 15144 and 13614, and specifically for the user agent string “SecurityNotifier.”
• Regularly check for suspicious registry entries, particularly under HKCUSoftwareMicrosoftWindowsCurrentVersionRunSecurityService.
• Review Scheduled Tasks for any unauthorized entries, such as “SystemCheck.”
• Configure endpoint detection and response (EDR) tools to flag instances of fodhelper.exe being used in conjunction with modifications to HKCU registry keys.
• Educate users about the dangers of downloading game cheats, trading tools, or any software from unverified third-party sources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.