VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems
New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.
VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.
- Implant steals Chromium, Firefox, and IE credentials and hunts .env, .conf, and .config files for API keys and cloud secrets.
- UAC bypass hijacks a debug object from winver.exe to launch elevated computerdefaults.exe without a prompt.
- Hidden VNC sessions, keylogging, SOCKS5 proxying, and regex clipboard replacement of crypto wallet addresses support fraud.
- Victims concentrated in the US, Russia, and Germany; one Windows Server 2025 host showed rapid data theft activity.
- ATT&CK
- T1548.002 Bypass User Account ControlT1555.003 Credentials from Web BrowsersT1056.001 KeyloggingT1115 Clipboard DataT1204 User Execution
- Products
- VectraHub
- Organizations
- SOCRadar
- Countries
- United StatesRussiaGermany
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | verify-cloud.digital | 53850). 86.109.75.161 ClickFix distribution panel, resolves verify-cloud.digital. 178.16.54.148 ClickFix panel serving VectraRAT and NetSupp |
| ipv4 | 178.16.54.148 | ClickFix distribution panel, resolves verify-cloud.digital. 178.16.54.148 ClickFix panel serving VectraRAT and NetSupport RAT (Omegat |
| ipv4 | 195.20.115.77 | ing VectraRAT and NetSupport RAT (Omegatech LTD, AS202412). 195.20.115.77 Secondary cluster, exposed panel and directory (ServerAstra |
| ipv4 | 86.109.75.161 | nd panel, exposed open directory (GorillaServers, AS53850). 86.109.75.161 ClickFix distribution panel, resolves verify-cloud.digital. |
| ipv4 | 86.109.75.168 | e. The entry point was an HTTP-accessible open directory on 86.109.75.168, a GorillaServers node in AS53850. That licensing architect |
| ipv4 | 91.219.236.179 | luster, exposed panel and directory (ServerAstra, AS56322). 91.219.236.179 Related infrastructure (ServerAstra). Note: IP addresses an |
From the original article
4 min read at gbhackers.com
VectraRAT, a previously undocumented Malware-as-a-Service platform that combines remote-access trojan capabilities with automated credential theft and a silent Windows privilege-escalation chain. Unlike the large number of commodity RATs that recycle leaked AsyncRAT, XWorm, or QuasarRAT code, VectraRAT appears to be a purpose-built, full-stack product maintained by a single developer.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.