New Java‑Based QuimaRAT RAT Offered as Malware‑as‑a‑Service Targets Windows, Linux, macOS
What Happened — Researchers at LevelBlue have uncovered QuimaRAT, a Java‑based remote‑access trojan sold under a Malware‑as‑a‑Service (MaaS) model. The RAT runs on Windows, Linux and macOS and is priced from $150 per month to $1,200 for lifetime access, offering capabilities such as command execution, keylogging, screenshot capture and data exfiltration.
Why It Matters for Compliance & Audit Readiness
- The cross‑platform nature expands the attack surface for any organization, making continuous monitoring of privileged access a SOC 2 control requirement (CC6.1, CC6.2).
- MaaS pricing lowers the barrier for low‑skill actors, reinforcing the need for documented access‑control policies, MFA enforcement and regular security‑awareness training.
- Evidence of endpoint monitoring and incident response can serve as audit‑ready artifacts to demonstrate a mature SOC 2 program.
Who Is Affected — Any enterprise with mixed‑OS endpoints—finance, healthcare, SaaS providers, and other sectors that rely on Windows, Linux or macOS workstations.
Recommended Actions —
- Enforce MFA and least‑privilege for all remote‑access tools.
- Deploy EDR/AV solutions capable of detecting anomalous Java processes and RAT behaviors.
- Update security‑awareness training to include RAT‑as‑a‑Service threats and phishing vectors.
- Map endpoint access‑control policies to SOC 2 CC6.1/CC6.2 and collect continuous logs as audit evidence.
Source: The Hacker News
Technical Notes — QuimaRAT is written in Java, enabling it to run unchanged on Windows, Linux and macOS. It provides typical RAT functions (command shell, keylogging, screenshot, file upload/download) and is distributed via a subscription model; no specific CVE is associated.