GOVRAT V2.0

GOVRAT V2.0
ATTACKING US MILITARY AND GOVERNMENT
The organizations targeted by the GovRAT v2.0 malware primarily conduct their operations in English.
However, several samples with non-English signatures for data exfiltration related to names of the
documents, their security classification, author and additional details have been identified.
In most cases, the bad actors perform two stages of drive-by download attacks. The first stage targets the
initial victim and the second stage targets the server-side compromise (regarding other employees). This
multi-stage approach allows the bad actors to target a broad number of victims, progressing from a single
infection, leading to deeper intrusions into specific organizations and data exfiltration which can include a
variety of record attributes or data elements.
ABOUT INFOARMOR
InfoArmor offers industry-leading identity and cyber intelligence services that
help our clients fight emerging fraud and advanced cyber threats. We combine an
unparalleled global research network with big data analysis, actionable intelligence
and customized service to meet clients’ dynamic security needs. From employee
to enterprise, InfoArmor is redefining how organizations fight fraud and combat an
evolving threat landscape to mitigate risk on multiple levels.
Today, more than 600 businesses and government agencies, including 50 of the
Fortune 500, use PrivacyArmor ® , the industry leading employee identity protection
solution, or VigilanteATI TM , our award-winning advanced threat intelligence platform to
improve their data security posture.
For more information please visit the InfoArmor website at infoarmor.com, or contact
InfoArmor sales at +1 480 302 6701, or email sales at ati@infoarmor.com.
20