SparkRAT (Open-source, cross-platform RAT)

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Malware / Remote Access Trojan (RAT) — Origin: Unknown (tool used by multiple threat clusters)

Author: iQBlack CTI Team

Executive Summary

SparkRAT is a cross-platform Remote Access Trojan (RAT) written in Go and distributed as an open-source toolset (agent + C2/server). Public reporting consistently frames it as a commodity post-compromise capability rather than a single-actor-exclusive implant, which complicates attribution at the ‘actor’ level and shifts analysis toward campaigns and clusters that deploy it.

Operationally, SparkRAT functions as an interactive remote administration capability (command execution, file operations, system profiling and other operator-driven actions). As an open-source RAT, its code can be modified, recompiled, and refactored, meaning static indicators (strings, file hashes) are brittle and must be paired with behavior-based hunting.

Public reporting links SparkRAT use to multiple intrusion contexts, including espionage-oriented activity where SparkRAT was loaded by an intermediate Go-based loader (LESLIELOADER) and operated via infrastructure documented in open reporting. Separately, early distribution has been observed via trojanized installers, illustrating that SparkRAT may appear both as a primary payload and as a secondary tool delivered post-access.