BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger - Palo Alto Networks BlogPalo Alto Networks Blog

Executive summary: Unit 42 describes BBSRAT, a custom RAT tied to the Roaming Tiger activity that targeted Russian organisations via spear-phishing and weaponized Office docs (CVE-2012-0158). The report documents two deployment methods (CAB sideloading with a malicious DLL and a PowerSploit-based downloader), persistence and process-injection behaviors, the C2 protocol and commands, YARA detection, and a comprehensive set of IOCs (file hashes, domains, IPs) and mitigation recommendations.