SOC Prime Bias: Critical

16 Nov 2025 09:01
newspaper icon IBM

“EndClient RAT” – New Kimsuky APT Malware

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
“EndClient RAT” – New Kimsuky APT Malware
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


EndClient RAT Analysis

EndClient RAT is a recently observed remote-access trojan tied to the Kimsuky cluster that arrives via signed binaries or script droppers (using stolen code-signing certificates to evade SmartScreen/AV), provides remote shell/command execution, file upload/download, persistence, and C2 over HTTP(S), has so far shown low detection rates, and was documented in initial technical reports with IOCs.

Immediate actions include collecting file hashes and certificate serials, blocking known C2 domains/URLs, revoking or pinning unexpected code-signing certs, enabling application-whitelisting, tightening email/attachment controls, and hunting for anomalous signed executables.

Attack Flow

CVE-2025-59287 Simulation

Executive Summary

Test Case ID: TC-20251106-A1B2C
TTPs: T1071.002 – Application Layer Protocol: Web Protocols, T1132.001 – Standard Cryptographic Protocol, T1132.002 – Non‑Standard Port Protocol
Detection Rule Logic Summary: Detects any firewall event where the destination IP is 116.202.99.218, destination port 443, and the payload contains one or more of the EndClient RAT JSON markers (endClient9688, endServer9688, endServerFile9688, endClientFile9688).
Detection Rule Language/Format: Sigma (YAML)
Target Security Environment: Windows OS, Windows Firewall logging (Sysmon optional), SIEM that ingests firewall logs (e.g., Microsoft Sentinel, Splunk, Elastic).
Resilience Score (1‑5): 3 – Moderately effective; relies on payload inspection of firewall logs which can be evaded by encrypting traffic or using a proxy.

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for free