New I2PRAT Malware: Advanced, Undetectable?

Sekoia researchers report on I2PRAT, a sophisticated Remote Access Trojan observed since November 2024 as part of the ClickFix campaign that uses the I2P anonymization network for C2. The malware employs a three-stage chain (binder/packer → obfuscated loader → final RAT), advanced privilege escalation (parent PID spoofing, RPC-based UAC bypass attempts), dynamic API resolution, anti-debugging, AES-128-CBC communications with per-infection keys, and persistence via a stealth service named "RDP-Controller" while disabling Microsoft Defender and modifying the Windows Filtering Platform; recommended detection includes monitoring SeDebugPrivilege changes, suspicious registry/RDP modifications, and TCP connections to I2P nodes on ports 1110–1130.