Pentest Tools Gone Wrong: How Hackers Are Using the Brute Ratel Red Team Tool

New technologies make the world go round—we love when a digital advancement makes our lives easier or more efficient. But unfortunately, the tools we use to make our lives better can just as easily be used to exploit weaknesses and cause harm.

This is exactly what’s been happening with certain pentest and red team tools. Cybersecurity researchers and ethical hackers use these tools to test the security of systems and find vulnerabilities before malicious actors do. But sometimes, these same tools end up in the hands of threat actors, who then use them to launch real attacks.

What Are Pentest and Red Team Tools?

A pentest is an evaluation used to identify as many cybersecurity vulnerabilities as possible in your systems.

Red teaming isn’t meant to find as many weaknesses as possible. Instead, red teams focus on specific targets and see how much damage can be done once they’ve infiltrated.

When red teaming, professionals are acting offensively as if they were hackers (as opposed to blue teaming, where professionals simulate defensive actions to prevent attacks).

Why Do Hackers Turn to Pentest and Red Team Tools?

These tools are built to do exactly what attackers want: get into systems, avoid detection, and give the operator remote control. When threat actors buy, steal or crack a copy, they can turn it against real targets, and security products may miss it because the tool is designed to blend in. This is why the security industry is working to stop these tools from being misused—but it’s a tough battle.

Because this kind of abuse is relatively new, many security tools aren’t yet tuned to catch it. That’s why it’s critical to work with a cybersecurity provider who understands how these tools are abused.

At adrytech, we prioritize the security of our customers, including when we perform pentests and red team tests. Here’s what you need to know about the Brute Ratel C4 attacks and tips to keep your business safe:

What Is Brute Ratel C4 (BRc4)?

Brute Ratel C4 (BRc4) is a red team tool that was created by a security engineer named Chetan Nayak. This program is specifically designed to get past endpoint detection and response and antivirus programs, which makes it very dangerous in the wrong hands.

As of May 16th, 2022, BRc4 had over 350 customers and cost $2,500 for each user for a 1-year license. While Brute Ratel C4 may not have thousands of customers, its abuse by attackers is likely a sign of what’s to come for other red team tools.

What Damage Have Brute Ratel Attacks Caused?

On May 19th, 2022, a sample of malware that contained a malicious payload associated with BRc4 was uploaded to a virus checker and was not flagged as malicious by any of the 56 security vendors that analyzed it.

The sample malware is packaged as an ISO file, which is usually delivered via a spear-phishing email or downloaded by a second-stage downloader. When the ISO file is double-clicked, it opens to show what looks like a Microsoft Word document resume of someone named Roshan Bandara, but the “resume” is really a Windows shortcut (LNK) file. When the user double-clicks on it, BRc4 is installed onto the user’s computer.

After Brute Ratel has been loaded onto a device, a hacker can remotely access the infected device to run commands and spread farther throughout the compromised network.

Once the hacker has access to the device, they can do a number of things such as install more programs, delete files, or even encrypt data and demand a ransom for the decryption key. And because this program is designed to evade detection, it can be very difficult for businesses to know that they’ve been hacked until it’s too late.

How Can You Protect Your Business from Abused Red Team Tools?

adrytech is taking specific precautions to help keep your business protected. We also love to educate our customers on ways they can take control and keep threat actors out of their systems.

In addition to working with a reliable cybersecurity expert, here are 7 tips to protect your systems against attacks like this one:

1. Be careful what you click: Hackers can often embed malicious code in links or attachments, so it’s important to be cautious about what you click on. Train your employees to recognize phishing attempts and only open attachments from trusted sources. Make sure that everyone follows good cyber hygiene practices.
2. Use a VPN: A VPN (virtual private network) encrypts your internet traffic and makes it harder for hackers to intercept your data.
3. Use multi-factor authentication (MFA): MFA adds an extra layer of security by requiring a second factor, such as a code from an authenticator app or a hardware security key, in order to log in.
4. Keep your software up to date: Hackers are constantly finding new ways to exploit vulnerabilities in software, so it’s important to keep your programs up to date with the latest security patches.
5. Establish company device and data policies: You should develop and implement comprehensive device and data policies company-wide to ensure your employees understand exactly what they are and aren’t allowed to do with company property. This includes offering Security Awareness Training to your staff so they understand the risks involved.
6. Use behavior-based endpoint detection: Tools like Brute Ratel are built to slip past traditional antivirus. Endpoint detection and response (EDR) that watches for suspicious behavior, such as a document launching a hidden program, gives you a better chance of catching them.
7. Block risky email attachments: Disk image files (such as ISO) and Windows shortcut (LNK) files are rarely needed in business email but are a common way to deliver malware. Block or quarantine them at your email gateway.

Cybersecurity is a constantly evolving field, so it’s important to stay up to date on the latest threats and how to protect yourself against them. adrytech is committed to keeping our customers safe and secure, so they can focus on running their business.

Stop Attacks That Abuse Red Team Tools with adrytech

adrytech provides cybersecurity solutions that help businesses protect themselves against the latest threats. We offer a comprehensive suite of products and services that can be tailored to your specific needs. Contact us today to learn more about how we can help you stay safe from attacks that abuse red team tools and other advanced threats!