VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

VectraRAT, a previously undocumented Malware-as-a-Service platform that combines remote-access trojan capabilities with automated credential theft and a silent Windows privilege-escalation chain.

Unlike the large number of commodity RATs that recycle leaked AsyncRAT, XWorm, or QuasarRAT code, VectraRAT appears to be a purpose-built, full-stack product maintained by a single developer.

The platform is rented rather than sold, with subscriptions beginning at $250 per month. Buyers receive access to the VectraHub Linux control server, a browser-based operator panel, a Windows payload builder, and Telegram support.

The developer, operating under the “Vectra” alias, is believed to be rebranding an older identity known as “Nyxel,” whose public footprint stretches back to at least August 2022.

Subsequent infrastructure pivots uncovered more than ten related servers, dozens of samples, and evidence of distinct buyer-operated campaigns.

VectraRAT consists of a Go-based Linux command-and-control server named VectraHub and a native C++ implant for Windows hosts.

The hub embeds a Vue3-based web panel directly inside the binary, allowing operators to deploy a single executable on a virtual private server and expose the management interface without relying on a separate web stack.

The malware communicates over TCP port 3308 through a proprietary binary protocol using a five-byte message header and MessagePack-encoded payloads.

This design avoids common HTTP-based C2 patterns and may reduce visibility for defenses focused narrowly on web traffic inspection.

The operator panel allows buyers to create customized Windows payloads, modify embedded C2 settings, alter PE metadata, and enable a “Bypass UAC” option before building the implant.

Default resource metadata such as “Product Vectra,” “Company Vectra,” and version “0.2” provide a practical hunting opportunity when operators fail to customize the payload.

VectraRAT also uses RSA-PSS-SHA256 license validation, preventing buyers from easily forging server licenses or independently operating cloned infrastructure.

The entry point was an HTTP-accessible open directory on 86.109.75.168, a GorillaServers node in AS53850.

That licensing architecture reinforces the platform’s rental model and keeps the developer in control of the ecosystem.

The malware’s feature set spans both post-exploitation and credential-theft activity.

Once connected, VectraRAT can automatically collect browser credentials from Chromium, Firefox, and Internet Explorer, enumerate active network connections, and search for .env, .conf, and .config files that may contain API keys, database credentials, or cloud secrets.

Operators can then interact with selected systems through hidden virtual network computing, remote shell access, keylogging, SOCKS5 proxying, file transfer, process enumeration, and clipboard monitoring.

Its clipboard module supports regex-based replacement, enabling attackers to replace copied cryptocurrency wallet addresses with attacker-controlled values.

STRU identified live VectraRAT, infrastructure on June 23, 2026, after finding an exposed directory containing the VectraHub server binary, Windows payloads, license files, and panel logs.

The hidden desktop functionality is particularly concerning because it provides an isolated desktop session that victims do not see.

Attackers can use such access to operate browsers, access internal applications, or conduct fraud while minimizing visible signs on the compromised endpoint.

VectraRAT Malware-as-a-Service

VectraRAT’s UAC bypass is a major differentiator. The technique reportedly corresponds to UACME method 41, enhanced with debug-object handle hijacking.

The patchExeHostReplaceRuns function locates each block with bytes.Index and overwrites it with memmove. Icon and VERSIONINFO edits go through the public winres library.

It abuses Windows auto-elevating binaries, including computerdefaults.exe, to launch a malicious child process at High Integrity without presenting a User Account Control prompt.

The chain starts by launching winver.exe under a debug flag, obtaining its debug-object handle through native Windows APIs, detaching the debug object, and reusing it to debug an auto-elevated computerdefaults.exe process.

The implant then duplicates the elevated process handle and creates a payload process that inherits the elevated token.

Defenders should investigate suspicious computerdefaults.exe child processes, rapid winver.exe launch-and-exit behavior, and use of APIs including NtQueryInformationProcess, NtRemoveProcessDebug, and DbgUiSetThreadDebugObject.

STRU recovered 38 genuine victim sessions in less than one week, with 48% involving corporate Windows editions such as Enterprise, Enterprise LTSC, IoT Enterprise LTSC, and Windows Server 2025.

Geographically, the United States leads with seven unique victims, followed by Russia with four and Germany with three, with further hits in Switzerland, the Czech Republic, India, and Venezuela.

One observed Windows Server 2025 victim experienced multiple file transfers and command activity within 25 minutes, suggesting active data theft rather than simple reconnaissance.

Threat actors have delivered VectraRAT through the Amadey loader and ClickFix social-engineering pages, including tax-themed lures impersonating TurboTax.

ClickFix campaigns typically persuade victims to open the Windows Run dialog and paste a PowerShell command, turning the user into the execution mechanism.

Organizations should reinforce a simple rule: legitimate verification pages never instruct users to paste commands into Run, PowerShell, Terminal, or Command Prompt.

High-value detection signals include the mutex LocalVectra.Client.SingleInstance, %TEMP%\callback.json, long-lived outbound TCP 3308 traffic, suspicious PowerShell execution, and unexpected access to secret-bearing configuration files.

VectraRAT demonstrates how mature MaaS offerings are increasingly merging credential theft, stealthy remote control, and privilege escalation into a single rentable service.

IOCs

Address	Role
86.109.75.168	Primary C2 and panel, exposed open directory (GorillaServers, AS53850).
86.109.75.161	ClickFix distribution panel, resolves verify-cloud.digital.
178.16.54.148	ClickFix panel serving VectraRAT and NetSupport RAT (Omegatech LTD, AS202412).
195.20.115.77	Secondary cluster, exposed panel and directory (ServerAstra, AS56322).
91.219.236.179	Related infrastructure (ServerAstra).

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC