Babylon RAT Unleashed: Malaysian Politicians Under Cyber Siege

A Cyble Research and Intelligence Lab investigation found a targeted cyber espionage campaign active since July 2023 that uses malicious ISO files to deploy the Babylon RAT against Malaysian political and government figures; the delivery uses shortcut-based PowerShell execution to launch a hidden executable named "controller.exe" while showing a decoy PDF, creates registry persistence, employs AES-256 encryption and a ~300MB overlay for evasion, and connects to C2 servers (149.28.19.207 and 64.176.65.152) over port 443 to exfiltrate data and enable remote control.