SpankRAT Exploits Windows Explorer Processes for Stealth and Delayed Detection

SpankRAT is a stealthy two-component Rust Remote Access Trojan that abuses legitimate Windows processes (injecting rmm_agent.dll into explorer.exe) to mask C2 traffic over WebSockets, persist via a high-privilege Scheduled Task (RmmAgentCore), and provide a broad set of remote control capabilities; investigators provide IOCs (C2 IPs, file names, agent hash, drop path) and warn that samples were largely undetected on VirusTotal, highlighting the need for behavioral and sandbox analysis.