Researchers at SOCRadar have documented VectraRAT, a previously undocumented malware-as-a-service platform that includes a full-featured Windows implant, its own command-and-control infrastructure and an operator panel. What distinguishes it from the rest of the criminal market is that it was built from scratch rather than assembled from leaked or cracked components: "every layer of it, the Linux control server, the Windows implant, the protocol between them, the licensing that keeps operators paying, was written by the same developer", and none of it had been publicly documented before the report. That is a meaningful departure from the norm, where most remote-access tools sold on crimeware forums are a leaked AsyncRAT build, a cracked XWorm licence or a QuasarRAT fork with a new icon and name. The pricing is the point for defenders and for anyone assessing the market's maturity: the platform costs customers US$250 a month for turnkey access to enterprise Windows environments, including the licensing mechanism that sustains recurring revenue for the developer. A full-stack product at consumer-subscription pricing compresses both the technical skill and the capital required to run an intrusion — the operator no longer needs to understand, maintain or update anything below the operator panel. Read alongside the KREMLIN ecosystem documented today by Elastic, where a single developer maintained multi-stage JavaScript loaders, custom C++ installers and a Chrome extension capable of forging the browser's own integrity checks across fifteen months and seven campaigns, the picture is one of vertically integrated criminal toolmakers who own their entire stack. For defenders, the practical consequence is that tool-specific indicator lists age quickly when the developer can push an update to every customer; behavioural detection of remote-access tooling patterns and of the licence-driven persistence these platforms require is the more durable control.

• Source article