{"id":90116,"date":"2021-07-01T19:30:31","date_gmt":"2021-07-01T14:00:31","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=90116"},"modified":"2023-08-08T18:16:15","modified_gmt":"2023-08-08T12:46:15","slug":"warzone-rat-beware-of-the-trojan-malware-stealing-data-triggering-from-various-office-documents","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/warzone-rat-beware-of-the-trojan-malware-stealing-data-triggering-from-various-office-documents\/","title":{"rendered":"WARZONE RAT \u2013 Beware Of The Trojan Malware Stealing Data Triggering From Various Office Documents"},"content":{"rendered":"

Warzone RAT is part of an APT campaign named \u201cConfucius.\u201d Confucius APT is known to target government sectors of China and a few other South Asian countries. This APT campaign was quite active around January 2021. Warzone RAT first emerged in 2018 as malware-as-a-service (MaaS) and is known for its aggressive use of \u201c.docx\u201d files as its initial infection vector. The initial payload is known as \u201cAve Maria Stealer,\u201d which can steal credentials and log keystrokes on the victim\u2019s machine. The advanced version of this malware is currently sold in the underground market for $22.95 per month and $49.95<\/span><\/span> for three months. The Warzone creators have an official website where it’s up for sale.<\/p>\n

\"\"<\/p>\n

Figure 1: Warzone website showing selling price<\/em><\/p>\n

These are the various features of the RAT mentioned on the website:<\/p>\n