New Salat Malware Uses QUIC and WebSocket Channels for Stealthy Remote Control

Salat is a sophisticated Go-based remote access trojan offering extensive data theft (browsers, crypto wallets, messaging tokens, clipboard), live desktop and webcam streaming, keystroke logging, remote shell access, and multiple persistence mechanisms. It uses QUIC and WebSocket to blend communications with legitimate traffic, stores doubly-encrypted C2 addresses with a TON blockchain fallback for resiliency, and includes IoCs (hashes and C2 URLs) published by researchers.