QuimaRAT v2.0: Cross-Platform Java-Based RAT Sold via Malware-as-a-Service Model

QuimaRAT v2.0 (TL-2026-1389), also tracked as Quima Control, is a high-severity malware campaign, first published 2026-07-15. It has no confirmed attribution, affects N/A (cross-platform crimeware, not a vendor product vulnerability), maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1389

Threat ID
TL-2026-1389
Also known as
Quima Control, QuimaRAT v2.0
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-15
Last reviewed
2026-07-15
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
unknown opportunistic commodity maas not sector-targeted
Target regions
global
Detection rules
9
Indicators of compromise
18

Malware and tooling in QuimaRAT v2.0

Malware and tooling: QuimaRAT, Quima Builder, Quima Control, Quima Dropper, Quima Loader, QuimaRAT C2 (TCP/WebSocket/TLS/HTTPS multi-transport)

QuimaRAT is a Java-based, cross-platform (Windows/Linux/macOS) remote access trojan advertised on dark-web forums under a subscription malware-as-a-service model. It ships with a full toolkit — Quima Control (the RAT), Quima Builder, Quima Loader, and Quima Dropper — supporting dynamic capability expansion through encrypted, C2-delivered plugins and browser-cache payload delivery designed to bypass Windows SmartScreen.

How QuimaRAT v2.0 works

QuimaRAT is a modular Java-based remote access trojan first documented publicly by LevelBlue SpiderLabs researchers Chen Aviani and Nikita Kazymirskyi on 2026-06-25, with broad follow-on trade-press coverage (Intel 471, The Hacker News, SC Media, SecureReading, and others) beginning around 2026-07-06. The malware is built as an Apache Maven project (two distinct pom.xml build files) targeting the JVM (Java SE 8), and embeds Java Native Access (JNA) native libraries compiled for Windows, Linux, and macOS across multiple CPU architectures, giving a single Java codebase genuine cross-platform reach without per-OS rewrites.

The malware suite is sold as a four-part toolkit: Quima Control (the core RAT/implant), Quima Builder (payload generator), Quima Loader (a browser-cache-based web stager), and Quima Dropper (an HTML/SVG-based social-engineering payload generator). Quima Builder can package the implant into JAR, EXE, APP, SH, BAT, and VBS formats, and the wider toolkit additionally supports XLL, LNK, JS, DOCM, XLSM, MSC, CPL, and CHM delivery formats — giving affiliates a payload format for nearly any phishing pretext or living-off-the-land execution host (mshta, wscript, Office macros, Control Panel applets, compiled HTML help).

Quima Loader's signature technique deposits the malicious payload into the victim browser's local disk cache from an attacker-controlled web page (fake CAPTCHA verification pages and fake software-update prompts are the observed lures), then has a small, largely inert stager retrieve and locally execute the cached file — a technique intended to reduce the network/download telemetry that endpoint security and Windows SmartScreen reputation checks rely on. Quima Dropper achieves a similar effect using HTML/SVG smuggling.

Once running, QuimaRAT decrypts an embedded configuration file (config.dat, protected with a repeating-key XOR routine) that drives environment validation, persistence installation, and C2 initialization. LevelBlue's analysis catalogued 23 implemented commands plus 212 additional protocol-only (stubbed/reserved) commands in the version analyzed, consistent with the vendor's own marketing claim of 70+ modules across the Windows (74) and Linux/macOS (46) module sets. Core capabilities include remote interactive command execution, remote payload/plugin delivery (load/unload/update at runtime without reinstalling the core implant), credential theft, clipboard monitoring and manipulation, file upload/download, webcam surveillance, and fileless in-memory shellcode execution on Windows hosts.

C2 communications use TCP by default with WebSocket, TLS, and HTTPS as alternate transports, plus dedicated HANDSHAKE and HEARTBEAT protocol commands for connection resiliency and automatic reconnection. Operators can additionally configure a Pastebin-hosted C2 address list, letting them rotate C2 infrastructure by editing a paste rather than rebuilding and redistributing payloads.

Persistence is OS-specific: Windows uses Registry Run keys, Scheduled Tasks, and Startup-folder entries; Linux uses .desktop autostart entries and crontab reboot jobs; macOS uses LaunchAgent plist files. Evasion features include single-instance enforcement via a Java FileLock-protected .lock file, OS/environment fingerprinting to detect sandboxes and virtual machines before continuing execution, an optional "Binder" mode that launches a decoy/legitimate application alongside the implant to reduce user suspicion, and build-time ProGuard class-name obfuscation plus Maven Shade Plugin package relocation to hinder static analysis and signature matching. The developer markets the toolkit with claims such as building payloads around "what Windows already trusts" and asserting AV/EDR evasion ("FUD").

QuimaRAT is monetized purely as MaaS: $150 for one month, $300 for three months, $500 for six months, $700 for twelve months, and $1,200 for lifetime access — pricing deliberately low enough to lower the barrier to entry for less-skilled threat actors and cybercrime affiliates who lack in-house malware-development capability. No CVE, specific victim sector, or attributed threat-actor group/nation-state was disclosed in any source reviewed; the malware is developer/vendor-distributed crimeware rather than a nation-state implant, so attribution is to the (unnamed) MaaS developer/seller rather than to an APT.

MITRE ATT&CK techniques used in TL-2026-1389

Collection

T1005 Data from Local System; T1115 Clipboard Data; T1125 Video Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1585 Establish Accounts; T1587 Develop Capabilities

Affected products and versions in QuimaRAT v2.0

  • N/A (cross-platform crimeware, not a vendor product vulnerability) — Windows, Linux, and macOS endpoints (any host capable of running a JVM / JAR payload)
    Vulnerable versions: Windows (Registry/Scheduled Task persistence path); Linux (.desktop/cron persistence path); macOS (LaunchAgent persistence path)

Remediation for QuimaRAT v2.0

Immediate actions

  • Block execution of unsigned/uncommon JAR, VBS, BAT, SH, LNK, CHM, and MSC files delivered via email or browser download at the endpoint/EDR and email-gateway layer
  • Enable and enforce Windows SmartScreen and Attachment/Mark-of-the-Web enforcement for browser-cache and download-directory execution paths
  • Block or restrict outbound connections to raw TCP, WebSocket, and Pastebin (pastebin.com and clones) from endpoint processes not associated with approved software
  • Require Java Runtime Environment execution policy restrictions (application allow-listing) on endpoints that do not need a JVM installed
  • Hunt for the published SHA-256 sample hash and any JAR/EXE/APP/SH/BAT/VBS artifacts matching QuimaRAT build characteristics across EDR telemetry

Workarounds

  • Disable or restrict Java Runtime Environment on endpoints where a JVM is not a business requirement
  • Restrict browser cache execution paths via application control policy where feasible

Longer-term hardening

  • Deploy EDR with behavioral detection for browser-cache-based payload execution and fileless/in-memory shellcode execution on Windows
  • Implement application allow-listing (Windows Defender Application Control / AppLocker) to prevent execution of JAR/VBS/BAT/HTA/CHM/MSC from user-writable and browser-cache directories
  • Monitor for anomalous cron, .desktop autostart, LaunchAgent plist, and Registry Run-key creation across all three OS families as a cross-platform persistence hunting baseline
  • Deploy network detection for Pastebin-style raw-paste-fetch beaconing patterns and long-lived raw-TCP/WebSocket connections to non-corporate infrastructure
  • User awareness training targeting fake CAPTCHA-verification and fake software-update phishing pretexts, the primary observed QuimaRAT lure themes

Timeline of QuimaRAT v2.0

  • LevelBlue SpiderLabs researchers Chen Aviani and Nikita Kazymirskyi publish the initial technical analysis of QuimaRAT (v2.0), documenting its Maven-based Java architecture, embedded JNA native libraries, 23 implemented plus 212 protocol-only commands, and XOR-encrypted config.dat.
  • Security news video roundup covers QuimaRAT MaaS alongside other emerging threats, indicating the story reached mainstream security-news aggregation channels.
  • elhacker.NET publishes a Spanish-language summary ('Nueva variante de QuimaRAT basada en Java disponible como servicio para Windows, Linux y macOS'), extending awareness of the threat to Spanish-speaking security audiences.
  • The KSEC Community Forum threads the QuimaRAT MaaS story, indicating discussion uptake within practitioner community channels.
  • Bright Nexus publishes a cybersecurity-advisory article syndicating the QuimaRAT MaaS disclosure to its advisory subscriber base.
  • Pentagon Design republishes the QuimaRAT MaaS coverage, further syndicating the LevelBlue technical findings.
  • SecureReading publishes 'QuimaRAT Java RAT Targets Windows, Linux, and macOS Through Malware-as-a-Service,' reiterating the builder/loader/dropper toolkit and pricing structure.
  • SC Media publishes a brief on QuimaRAT targeting Windows, Linux, and macOS via the MaaS model, extending trade-press reach of the LevelBlue disclosure.
  • The Hacker News (Ravie Lakshmanan) publishes 'New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS,' summarizing the LevelBlue findings and MaaS pricing tiers for a mainstream security-news audience.
  • RESEARCH phase consolidates LevelBlue SpiderLabs' original technical analysis with seven independent trade-press summaries to build the complete threat record, MITRE mapping, and IOC set.
  • TL-Intel-Harness HUNT phase ingests the Intel 471 article via RSS and creates threat skeleton TL-2026-1389 for RESEARCH; no CVE, attribution, or IOCs were present in the seed article.
  • Intel 471 publishes 'Emerging Threat: QuimaRAT' blog entry flagging the malware for its subscribers, cited as the hunt source for this record; no new technical detail beyond prior LevelBlue reporting.

Sources cited for QuimaRAT v2.0

Threats related to QuimaRAT v2.0

Detection coverage for TL-2026-1389

As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1389 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats