The Secret Life of RATs: connecting the dots by dissecting multiple backdoors

This report analyzes multiple RAT/backdoor families (micDown, RatelS, SlyMongo, HemiGate, PlugX), documents code- and implementation-level similarities across samples, links those samples to threat actors (GroundPeony, Ratel Master, Earth Estries), identifies shared C2 infrastructure and VT uploads, provides IoCs (hashes, filenames, domains), and supplies YARA rules to detect loaders and payloads; the authors conclude there is likely code/infra sharing or collaboration among the groups and provide detection guidance.