Alert: Cybercriminals Deploying VCURMS and STRRAT Trojans via AWS and GitHub

A recent phishing campaign distributes a malicious Java downloader (e.g., Payment-Advice.jar) hosted on AWS that pulls and executes two Java-based RATs — VCURMS and STRRAT. The report details TTPs including use of public hosting (AWS/GitHub), a commercial protector to evade detection, a ProtonMail address used for C2 communications, and extensive infostealer and keylogging capabilities (credential/cookie theft, screenshots, system enumeration); it also notes related phishing leveraging Dropbox-hosted PDFs linking to fraudulent domains.