Unraveling Greenbug Group's RAT: Keylogging, Powercat, and Beyond

NCC Group published a technical breakdown of ISM RAT (also called Ismdoor) version 5.0.0, the HTTP-based remote access trojan used by Greenbug to spy on targets before that group later switched to a DNS-based communication channel. The report reveals that v5.0.0 introduced significant new capabilities — keylogging, credential theft via Mimikatz, Powercat shell access, and UAC bypass — making it substantially more dangerous than earlier versions. Greenbug used this tool to gather user credentials and system information, which researchers suspect was a precursor step enabling the destructive Shamoon disk-wiping attacks on Saudi organizations.

The RAT is attributed to Greenbug, an Iranian-linked cyberespionage group. Symantec first identified the group and its connection to the Shamoon campaigns. NCC Group's analysis corroborates Symantec's and McAfee's prior work while going deeper into the malware's internal structure. NCC notes that despite Greenbug's broad toolset, the coding quality suggests the group is not technically elite — they copy-pasted standard code from MSDN examples and left debugging output in released samples.

ISM RAT's primary purpose is espionage and credential theft. It collects extensive system and user information — including running processes, network connections, installed security products, and user credentials via Mimikatz and keylogging. This reconnaissance and credential harvesting is believed to have enabled the Shamoon/Disttrack campaigns: once the RAT had stolen valid administrator credentials, Disttrack could spread across Saudi networks and wipe disks at a scheduled time. The RAT itself causes no direct destruction — its role is to gather access and intelligence for downstream operations.

Based on the samples analyzed and their submission origins, the campaign targeted organizations in Saudi Arabia. All known samples were submitted to VirusTotal from Saudi Arabia, and the suspected downstream Shamoon attacks hit Saudi companies. The campaign spans at least mid-2016 through early 2017, with the malware actively developed and versioned throughout that period.

The targeting aligns with the broader Shamoon campaign pattern — Saudi Arabian organizations, particularly in energy and critical infrastructure. NCC Group's report does not name specific victim sectors, but the credential theft goal and Shamoon connection point to high-value Saudi enterprises as the intended targets.

Once installed on a victim machine, ISM RAT communicates with attacker-controlled servers via HTTP POST requests, using Microsoft's standard WinHTTP library — blending in with normal web traffic. It runs a background check-in every few seconds to retrieve commands. When directed, it silently collects system information (users, network config, running services, installed security software), logs keystrokes, dumps Windows credentials using Mimikatz after bypassing UAC controls, opens a reverse shell via Powercat for interactive attacker access, and exfiltrates collected data back to the C2. Temporary files used during collection are deleted afterward to reduce forensic traces.

Saudi Arabian organizations — particularly in energy and critical infrastructure — are strategic targets for Iranian state-aligned actors. Compromising these organizations serves both intelligence collection and disruptive objectives. In this case, the stolen credentials appear to have been the key that unlocked the follow-on Shamoon attacks, which wiped thousands of machines at Saudi companies. Access gained through ISM RAT likely had outsized impact relative to the RAT's modest technical sophistication.