QuimaRAT v2.0: Cross-Platform Java-Based RAT Sold via Malware-as-a-Service Model — Threadlinqs Intelligence
As of 2026-07-15, QuimaRAT v2.0: Cross-Platform Java-Based RAT Sold via Malware-as-a-Service Model is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1389 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
QuimaRAT is a Java-based, cross-platform (Windows/Linux/macOS) remote access trojan advertised on dark-web forums under a subscription malware-as-a-service model. It ships with a full toolkit — Quima
QuimaRAT is a modular Java-based remote access trojan first documented publicly by LevelBlue SpiderLabs researchers Chen Aviani and Nikita Kazymirskyi on 2026-06-25, with broad follow-on trade-press coverage (Intel 471, The Hacker News, SC Media, SecureReading, and others) beginning around 2026-07-06. The malware is built as an Apache Maven project (two distinct pom.xml build files) targeting the JVM (Java SE 8), and embeds Java Native Access (JNA) native libraries compiled for Windows, Linux, and macOS across multiple CPU architectures, giving a single Java codebase genuine cross-platform reach without per-OS rewrites.
The malware suite is sold as a four-part toolkit: Quima Control (the core RAT/implant), Quima Builder (payload generator), Quima Loader (a browser-cache-based web stager), and Quima Dropper (an HTML/SVG-based social-engineering payload generator). Quima Builder can package the implant into JAR, EXE, APP, SH, BAT, and VBS formats, and the wider toolkit additionally supports XLL, LNK, JS, DOCM, XLSM, MSC, CPL, and CHM delivery formats — giving affiliates a payload format for nearly any phishing pretext or living-off-the-land execution host (mshta, wscript, Office macros, Control Panel applets, compiled HTML help).
Quima Loader's signature technique deposits the malicious payload into the victim browser's local disk cache from an attacker-controlled web page (fake CAPTCHA verification pages and fake software-update prompts are the observed lures), then has a small, largely inert stager retrieve and locally execute the cached file — a technique intended to reduce the network/download telemetry that endpoint security and Windows SmartScreen reputation checks rely on. Quima Dropper achieves a similar effect using HTML/SVG smuggling.
Once running, QuimaRAT decrypts an embedded configuration file (config.dat, protected with a repeating-key XOR routine) that drives environment validation, persistence installation, and C2 initialization. LevelBlue's analysis catalogued 23 implemented commands plus 212 additional protocol-only (stubbed/reserved) commands in the version analyzed, consistent with the vendor's own marketing claim of 70+ modules across the Windows (74) and Linux/macOS (46) module sets. Core capabilities include remote interactive command execution, remote payload/plugin delivery (load/unload/update at runtime without reinstalling the core implant), credential theft, clipboard monitoring and manipulation, file upload/download, webcam surveillance, and fileless in-memory shellcode execution on Windows hosts.
C2 communications use TCP by default with WebSocket, TLS, and HTTPS as alternate transports, plus dedicated HANDSHAKE and HEARTBEAT protocol commands for connection resiliency and automatic reconnection. Operators can additionally configure a Pastebin-hosted C2 address list, letting them rotate C2 infrastructure by editing a paste rather than rebuilding and redistributing payloads.
Persistence is OS-specific: Windows uses Registry Run keys, Scheduled Tasks, and Startup-folder entries; Linux uses .desktop autostart entries and crontab reboot jobs; macOS uses LaunchAgent plist files. Evasion features include single-instance enforcement via a Java FileLock-protected .lock file, OS/environment fingerprinting to detect sandboxes and virtual machines before continuing execution, an optional "Binder" mode that launches a decoy/legitimate application alongside the implant to reduce user suspicion, and build-time ProGuard class-name obfuscation plus Maven Shade Plugin package relocation to hinder static analysis and signature matching. The developer markets the toolkit with claims such as building payloads around "what Windows already trusts" and asserting AV/EDR evasion ("FUD").
QuimaRAT is monetized purely as MaaS: $150 for one month, $300 for three months, $500 for six months, $700 for twelve months, and $1,200 for lifetime access — pricing deliberately low enough to lower the barrier to entry for less-skil
Target sectors: unknown opportunistic commodity maas not sector-targeted
Target regions: global
References
- Emerging Threat: QuimaRAT
- Novel Java-Based QuimaRAT Targets Windows, macOS, and Linux
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS
- New QuimaRAT malware targets Windows, Linux, and macOS via MaaS model
- QuimaRAT Java RAT Targets Windows, Linux, and macOS Through Malware-as-a-Service
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS - Pentagon Design
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS - Bright Nexus
- New Java-Based QuimaRAT Malware-as-a-Service Targets Windows, Linux, and macOS
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS - KSEC Community Forum
- Nueva variante de QuimaRAT basada en Java disponible como servicio para Windows, Linux y macOS
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1189, T1204, T1059, T1059, T1106, T1129, T1547, T1053, T1053