LilacSquid APT Employs Open Source Tools, QuasarRAT

Cisco Talos researchers attribute a previously unknown APT dubbed LilacSquid to targeted data-exfiltration campaigns spanning the US, Europe, and Asia. LilacSquid gains initial access by exploiting public vulnerabilities and stolen RDP credentials, uses open-source remote management (MeshAgent) and tunneling (SSF), and employs InkLoader to deploy and run a heavily obfuscated custom QuasarRAT variant called PurpleInk to maintain long-term access and steal data; tactics overlap with North Korean groups such as Andariel/Lazarus.