DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal

Insikt Group identified a TAG-140 (APT36/SideCopy) campaign that used a cloned Indian Ministry of Defence press-release site and a ClickFix-style mshta lure to deliver a BroaderAspect loader which installs a new Delphi-based DRAT V2 RAT; the report documents DRAT V2’s server-initiated TCP C2 protocol, command set (including arbitrary shell execution), C2 obfuscation techniques, IOCs (hashes, domains, and C2 IPs), detection signatures (Snort, Sigma, YARA), and recommended mitigations.