Malware Family and Delivery Mechanism

AtlasCross is a previously undocumented remote access trojan (RAT) currently being distributed through an active campaign targeting Chinese-speaking users. The threat actors operate a network of at least eleven confirmed typosquatted domains that impersonate legitimate, trusted software brands across multiple categories: VPN clients, encrypted messaging applications, video conferencing platforms, cryptocurrency tracking tools, and e-commerce applications.

The delivery mechanism relies on users mistyping or being redirected to lookalike domains. Victims who land on these sites are served trojanized installers or malicious download packages that appear authentic. The breadth of impersonated software categories suggests the operators deliberately cast a wide net to maximize infection volume across different user demographics within the Chinese-speaking population.

The campaign does not exploit a specific CVE at this stage of public documentation. Instead, it relies on social engineering and domain spoofing to bypass user skepticism — a distribution model that requires no vulnerability in the impersonated software itself.

Capabilities: Persistence, Exfiltration, and C2

Persistence

AtlasCross establishes persistence using standard Windows mechanisms. Upon execution, the implant registers itself in the Windows registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, ensuring it survives system reboots without requiring elevated privileges. This low-privilege persistence approach allows deployment across standard user accounts.

Command-and-Control

The RAT communicates with attacker-controlled C2 infrastructure over encrypted channels. C2 beaconing behavior includes jitter intervals designed to blend with normal user-generated traffic patterns. The malware fingerprints the host on first contact, transmitting system metadata — OS version, hostname, username, installed software, and network configuration — to the C2 server before awaiting operator instructions.

Exfiltration and Remote Access

AtlasCross supports a standard RAT capability set:

  • File system access: Read, write, upload, and download files from arbitrary paths.
  • Screenshot capture: Periodic or on-demand screen grabs transmitted to C2.
  • Keylogging: Records keystrokes and buffers them for exfiltration.
  • Process execution: Operators can launch arbitrary commands and executables on the infected host.
  • Credential harvesting: Targets browser-stored credentials and session cookies from Chromium-based and Firefox-based browsers.
  • Clipboard monitoring: Captures clipboard content, particularly relevant for cryptocurrency wallet addresses given the campaign's targeting of crypto-tracking applications.

The clipboard monitoring capability combined with the impersonation of cryptocurrency tools indicates the operators prioritize financial theft alongside broader espionage objectives.

Affected Platforms

AtlasCross targets Windows endpoints exclusively based on current analysis. The trojanized installers are Windows PE executables or NSIS-packaged installers masquerading as setup files for legitimate software. No macOS or Linux variants have been identified at this time.

The affected user base is Chinese-speaking individuals globally — not limited to users in mainland China. The impersonated application categories (VPN clients in particular) are heavily used by Chinese-speaking users in regions where internet restrictions apply, expanding the potential victim pool across Southeast Asia, Taiwan, Hong Kong, and diaspora communities.

Organizations with Chinese-speaking employees who download software from unofficial sources face direct exposure.

Detection Signatures

Network Indicators Block and monitor outbound connections to the eleven confirmed typosquatted delivery domains. SOC teams should query DNS logs and proxy logs for requests to domains that closely resemble the following application categories with slight character substitutions or homoglyph replacements:

  • VPN client brand names
  • Encrypted messenger brand names (e.g., Telegram, Signal homoglyphs)
  • Video conferencing platforms
  • Cryptocurrency portfolio trackers

Threat intelligence platforms should be queried for the specific IOC list as it is updated by reporting vendors.

Host-Based Indicators

  • Registry key creation under HKCU\Software\Microsoft\Windows\CurrentVersion\Run by installer processes not matching known-good software signatures.
  • Unsigned or self-signed PE executables dropped to %AppData% or %Temp% directories during installation of any software downloaded outside official vendor channels.
  • Processes spawning from user-writable directories initiating outbound TCP connections on non-standard ports.

YARA Rule (Behavioral)

rule AtlasCross_RAT_Behavioral {
  meta:
    description = "Detects AtlasCross RAT persistence and staging behavior"
    author = "SOC Detection Engineering"
  strings:
    $reg_path = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide ascii
    $appdata_drop = "%AppData%" wide ascii
    $clipboard_api = "OpenClipboard" ascii
    $screenshot_api = "BitBlt" ascii
  condition:
    uint16(0) == 0x5A4D and
    all of them
}

EDR Query On CrowdStrike Falcon or Microsoft Defender for Endpoint, hunt for processes where the parent is an installer (msiexec.exe, nsis-named processes, or unsigned setup executables) that write to HKCU\Run and subsequently initiate outbound network connections within the same session.

Removal Guidance

  1. Isolate the host from the network immediately upon detection to prevent ongoing C2 communication and lateral movement.
  2. Delete the registry persistence key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run associated with the AtlasCross executable name.
  3. Remove the dropped binary from %AppData% or %Temp% as identified by EDR telemetry or manual investigation.
  4. Revoke and rotate credentials: Because AtlasCross harvests browser-stored credentials and monitors keystrokes, treat all credentials entered on the infected host as compromised. This includes email accounts, VPN credentials, cryptocurrency exchange accounts, and any SaaS applications accessed from the host.
  5. Audit clipboard history: If the host accessed cryptocurrency wallets while infected, audit transaction history for unauthorized transfers.
  6. Reimage the endpoint rather than attempting manual cleaning in high-sensitivity environments. The full capability set of AtlasCross — including any secondary payloads dropped via the remote execution function — may not be fully enumerable without complete forensic analysis.
  7. Block delivery domains at the DNS and proxy layer across the enterprise using the confirmed IOC list from your threat intelligence feed.
  8. Notify affected users to change passwords from a clean, uninfected device.

Organizations should enforce software installation policies that restrict downloads to vendor-verified sources and implement DNS filtering to catch typosquatted domains before users reach them.