New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Code

Summary

A new remote access trojan called GodRAT is targeting financial institutions. It uses steganography to hide malicious code and is based on the Gh0st RAT. Kaspersky discovered the source code and builder for GodRAT.

Key Takeaways

1. GodRAT, a new remote access trojan, is targeting financial institutions.
2. The malware uses steganography to conceal shellcode within image files.
3. GodRAT is based on Gh0st RAT, whose source code was leaked in 2008 and has been used by Chinese hacking groups.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article is from a reputable cybersecurity news source and cites a known cybersecurity company (Kaspersky). It provides specific technical details and timelines, enhancing its credibility. The claims are presented without sensationalism, focusing on factual reporting.

Bias assessment: Cybersecurity Threat Focused. The article focuses on the technical aspects of the malware and its potential impact on financial institutions. The language is neutral, aiming to inform readers about the threat rather than promote a specific agenda. The bias is towards highlighting cybersecurity risks.

Note: This article presents technical information about a malware threat. While the source is credible, readers should consult additional sources for a comprehensive understanding.

Credibility flag: Informative, Technical

Claimed Facts (7)

• This is a factual statement about the target and nature of the malware.
• This is a specific detail about the distribution method, attributed to a named source.
• This describes the technical method used in the attacks.
• This provides a timeline and geographic scope of the attacks.
• This describes the malware's structure and functionality.
• This is a verifiable action by a reputable source.
• This is a direct quote from a reputable source.

Opinions (3)

• While factual, the phrasing suggests the author finds this detail significant.
• The phrase "likely believed" indicates an opinion or assessment.
• This is an interpretation of the significance of the discovery.

Claims (3)

• While technically plausible, the article doesn't provide specific evidence to support this claim, making it difficult to verify without further investigation.
• The phrase "even run searches" implies this is a particularly noteworthy capability, which is subjective and lacks specific context.
• The article doesn't provide specific evidence or examples of this claim, making it difficult to verify without further investigation.

Key Sources

• Ravie Lakshmanan — Author
• Kaspersky — Russian cybersecurity company
• Saurabh Sharma — Kaspersky Researcher
• The Hacker News — Cybersecurity news source