{
  "family": "bump_rat",
  "sample_count": 0,
  "category": "trojan",
  "description": "Bump-Rat is a specialized malware family that has drawn attention for its targeted application in cyber espionage campaigns. Unlike broadly distributed commodity malware, Bump-Rat is typically deployed post-compromise as a secondary payload, designed specifically to maintain a stealthy and persistent foothold within high-value networks. It is characterized by its lightweight architecture and modular design, allowing operators to deploy specific functional plugins as needed, thereby minimizing its overall footprint on the host system. Bump-Rat's primary functions include executing arbitrary shell commands, exfiltrating targeted documents, and mapping internal network topologies. To evade detection, it often utilizes uncommon communication protocols or piggybacks on legitimate network traffic, making it challenging for standard intrusion detection systems to flag. Analyzing Bump-Rat requires deep forensic capabilities and behavioral monitoring.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BumpRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Bump-Rat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bump-Rat is a stealthy Remote Access Trojan used primarily for maintaining persistence in targeted cyber espionage."
      }
    },
    {
      "@type": "Question",
      "name": "How is Bump-Rat usually deployed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is typically deployed as a secondary payload after an initial compromise has already occurred."
      }
    },
    {
      "@type": "Question",
      "name": "What makes Bump-Rat difficult to detect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its lightweight, modular design and use of unconventional communication protocols help it evade standard detection."
      }
    },
    {
      "@type": "Question",
      "name": "What are the main functions of Bump-Rat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its functions include command execution, data exfiltration, and internal network reconnaissance."
      }
    },
    {
      "@type": "Question",
      "name": "What kind of campaigns use Bump-Rat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is most commonly associated with advanced persistent threat (APT) groups focusing on long-term espionage."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1048",
    "T1046",
    "T1105",
    "T1090"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1046",
      "name": "Network Service Scanning",
      "tactic": "Discovery"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Bump Rat binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Bump Rat installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Malwarebytes Labs Threat Intelligence - Trojan.BumpRAT Analysis",
      "url": "https://www.malwarebytes.com/blog/detections/trojan-bumprat"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2017-11882 Details",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11882"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2012,
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Small and Medium Businesses"
  ],
  "lineage": {
    "derived_from": [
      "visual_basic_rat_framework"
    ],
    "variants": [
      "bump_rat_v2",
      "trojan.bumprat"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-2012-0158",
    "CVE-2017-11882"
  ],
  "iocs": {
    "file_hashes": [
      "e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
      "f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9"
    ],
    "delivery": [
      "Phishing lures mimicking commercial purchase orders and shipping invoices",
      "Social engineering attachments distributed via Discord and Telegram gaming groups"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BumpRatServer",
      "Startup folder executable link '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bumprat.lnk'"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}