New NonEuclid RAT Evades Antivirus and Encrypts Critical Files

NonEuclid is a sophisticated C# Remote Access Trojan for .NET Framework 4.8 that combines advanced evasion (AV bypass, anti-VM, rootkit-like hiding), persistence (scheduled tasks, registry/service manipulation), privilege escalation (UAC bypass), credential and cryptocurrency wallet theft, and integrated ransomware that encrypts files (appending ".NonEuclid"). It is distributed via social media, underground forums, and phishing, supports remote control and lateral movement, and is increasingly observed in criminal marketplaces; mitigation recommendations include EDR deployment, threat intelligence sharing, strict privilege management, patching, and user awareness.