Threat reportMalwareTL-2026-4995
QuimaRAT: Java-based cross-platform Remote Access Trojan offered as Malware-as-a-Service
QuimaRAT: Java-based cross-platform Remote Access Trojan (TL-2026-4995), also tracked as Quima RAT, is a medium-severity malware campaign, first published 2026-11-01. It has no confirmed attribution, affects Microsoft Windows (any host with a Java runtime), maps to 20 MITRE ATT&CK techniques (T1027, T1027.006, T1053.003), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4995
- Threat ID
- TL-2026-4995
- Also known as
- Quima RAT, Quima Builder, Quima Loader
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, health, information-technology, government administration
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in QuimaRAT: Java-based cross-platform Remote Access Trojan
Malware and tooling: QuimaRAT, Quima Builder, Quima Dropper, Quima Loader
How QuimaRAT: Java-based cross-platform Remote Access Trojan works
QuimaRAT is a Java-based RAT sold as MaaS (USD 150/month to USD 1,200 lifetime) that runs on Windows, Linux and macOS from a single Java payload. It uses a modular design with encrypted plugins pulled from C2, plus a builder, loader and dropper suite that lowers the barrier for low-skill operators.
QuimaRAT was documented by LevelBlue SpiderLabs (analysis dated 2026-06-25, blog 2026-07-06, researchers Chen Aviani and Nikita Kazymirskyi) and by Intel 471 in an Emerging Threat report (2026-07-15). It is a modular Java project built with Apache Maven (two distinct pom.xml files) that targets a Java SE 8 JVM and embeds Java Native Access (JNA) native libraries for Windows, Linux and macOS across several CPU architectures. The same Java payload executes on all three operating systems. LevelBlue describes it as a modular Java RAT platform rather than a single static implant. Obfuscation indicators (ProGuard-class renaming, Maven Shade relocation, preserved runtime symbols) suggest the fingerprint can be rotated by the seller.
The seller advertises QuimaRAT v2.0 on dark web forums with claims of 70+ modules, AES-256 encryption, FUD status and a GUI panel. Reported subscription tiers are USD 150 (1 month), 300 (3 months), 500 (6 months), 700 (12 months) and 1,200 (lifetime). One source cites 74 Windows modules and 46 combined macOS/Linux modules. Runtime configuration is held in an encrypted config.dat embedded in the JAR and decrypted with a repeating-key XOR routine. Single-instance enforcement uses a .lock file in the OS temp directory via Java FileLock. Before execution the RAT performs OS-specific virtualization and analysis-environment checks, then installs OS-specific persistence: on Windows, Registry Run keys, scheduled tasks and the Startup folder; on Linux, .desktop autostart entries and crontab @reboot tasks; on macOS, a LaunchAgent plist.
C2 traffic can run over TCP, WebSocket, TLS and HTTPS and uses HANDSHAKE and HEARTBEAT commands for resilience. The configuration can also drive a Pastebin-based C2 host update mechanism. LevelBlue confirmed 23 static commands and found 212 protocol-only commands, which suggests runtime modules, uploaded binaries or fileless payloads delivered after infection (fileless shellcode execution is reported on Windows). Operators extend functionality by deploying encrypted plugins from C2. Because C2 domains vary per buyer, traffic originates from a java process, which can bypass some legacy network controls.
The supporting suite includes Quima Builder, which generates JAR, EXE, APP, SH, BAT and VBS payloads and additional launcher formats (XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, CHM). It also includes Quima Loader, a browser-cache delivery service: a landing page loads, the payload is fetched into the browser cache, a download button appears, the user runs the loader file, and the main payload executes while bypassing Windows SmartScreen. The Hacker News names the dropper Quima Dropper, an HTML/SVG payload generator, and reports 74 Windows and 46 macOS/Linux modules covering remote command execution, payload delivery, credential theft, persistence installation, file transfer, clipboard manipulation and webcam surveillance. Aviatrix reports delivery through deceptive landing pages such as fake CAPTCHA checks or software update alerts. The Hacker News lists one file hash (SHA-256 bb0fbcb1e47ec04aa55555f3769fbc6f09694de1e9baae59260356b26b5af6a7). No accessible source publishes domains, IPs or URLs, and C2 varies per buyer, so no network IOCs could be extracted or checked in BeaconBeagle. The full Intel 471 PDF was not readable. Attribution is unknown: the seller handle 'QuimaCODER' appeared only in a search-result snippet, not in any fetched primary text, and an aggregator's ToddyCat link is uncorroborated by LevelBlue or Intel 471, so neither is used for attribution. Severity MEDIUM is an analyst estimate. Defenders should hunt for java/javaw spawning from Office, script hosts or user-writable paths, new Java-launching persistence, and unexpected outbound connections from Java processes.
MITRE ATT&CK techniques used in TL-2026-4995
Defense Evasion
T1027 Obfuscated Files or Information; T1027.006 HTML Smuggling; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
T1053.003 Cron; T1053.005 Scheduled Task; T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder; T1547.013 XDG Autostart Entries
Execution
T1059.003 Windows Command Shell; T1059.004 Unix Shell; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1102.001 Dead Drop Resolver; T1573 Encrypted Channel
Collection
defense-impairment
Affected products and versions in QuimaRAT: Java-based cross-platform Remote Access Trojan
- Microsoft — Windows (any host with a Java runtime)
Vulnerable versions: Windows with Java SE 8 or later runtime - Linux — Linux distributions (any host with a Java runtime)
Vulnerable versions: Hosts with a Java runtime - Apple — macOS (any host with a Java runtime)
Vulnerable versions: Hosts with a Java runtime
Remediation for QuimaRAT: Java-based cross-platform Remote Access Trojan
Immediate actions
- Hunt for java/javaw processes launched from Office apps, wscript/cscript, mshta, cmd or user-writable directories
- Inspect Windows Run keys, scheduled tasks and Startup folder, Linux crontab @reboot and ~/.config/autostart .desktop entries, and macOS ~/Library/LaunchAgents plists for entries that launch java -jar
- Alert on outbound TCP, WebSocket or HTTPS connections initiated by java processes to rare destinations, and on Pastebin requests from Java processes
- Isolate hosts where an unexpected JAR with an embedded config.dat or a java.lock-style .lock file in the temp directory is found
Workarounds
- Enforce Mark-of-the-Web and SmartScreen policies and train users not to run files served from browser-cache download pages
Longer-term hardening
- Remove Java runtimes from endpoints that do not need them, or restrict execution via application control
- Block or detonate XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL and CHM attachments and downloads from untrusted sources
- Deploy EDR with behavioral coverage on Windows, Linux and macOS, since the same Java payload runs on all three
- Enforce egress filtering and TLS inspection to surface Java-originated C2 traffic
Timeline of QuimaRAT: Java-based cross-platform Remote Access Trojan
- LevelBlue SpiderLabs analysis date of the QuimaRAT v2.0 sample (Maven project, JNA libraries, config.dat XOR, 23 static and 212 protocol-only commands)
- Aviatrix Threat Research Center publishes a QuimaRAT brief noting delivery via deceptive landing pages (fake CAPTCHA checks, software update alerts) and browser-cache SmartScreen evasion
- The Hacker News and Daily Security Review report QuimaRAT as a cross-platform Java MaaS sold from USD 150/month to USD 1,200 lifetime
- LevelBlue publishes 'Novel Java-Based QuimaRAT Targets Windows, macOS and Linux' (authors Chen Aviani and Nikita Kazymirskyi) with MaaS pricing, builder formats, loader and persistence details
- Moncloa malware newsletter includes QuimaRAT among that week's notable malware
- CraftedSignal publishes a detection brief on QuimaRAT based on the Intel 471 report, focused on java/javaw process behavior and Java-originated C2 traffic
- Intel 471 publishes the Emerging Threat report on QuimaRAT describing the modular architecture, encrypted plugins, and builder/loader/dropper suite
Sources cited for QuimaRAT: Java-based cross-platform Remote Access Trojan
- Emerging Threat: QuimaRAT (Intel 471)
- Novel Java-Based QuimaRAT Targets Windows, macOS and Linux (LevelBlue SpiderLabs)
- QuimaRAT: A Java RAT with Burning Ambitions (LevelBlue research report)
- New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS (The Hacker News)
- QuimaRAT MaaS Sells Cross-Platform Java RAT for Windows, Linux, macOS (Daily Security Review)
- New QuimaRAT malware targets Windows, Linux and macOS via MaaS model (SC Media)
- QuimaRAT MaaS 2026 (Aviatrix Threat Research Center)
- QuimaRAT brief (CraftedSignal)
- QuimaRAT Java-based MaaS cross-platform detection and defense (Security Arsenal)
- Malware newsletter 2026: QuimaRAT, GodDamn y campañas APT (Moncloa)
Detection coverage for TL-2026-4995
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4995 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.