New Salat Malware Uses QUIC and WebSocket Channels for Stealthy Remote Control

The article discusses a new malware variant called "Salat" that leverages QUIC (Quick UDP Internet Connections) and WebSocket protocols to evade detection while establishing remote control over infected systems. Here are the key points:

1. Malware Overview:

   • Salat is a Go-based malware designed for Windows operating systems.
   • It uses unconventional communication channels like QUIC and WebSocket to avoid traditional network monitoring tools.

2. Communication Channels:

   • The malware establishes connections with its command-and-control (C2) servers using both QUIC and WebSocket protocols.
   • These protocols are less commonly monitored by security solutions, making Salat harder to detect.

3. Persistence Mechanisms:

   • Salat employs several methods to ensure persistence on infected systems:
     • Creates a scheduled task that runs the malware at system startup.
     • Adds registry entries to maintain its presence.
     • Copies itself to common directories like C:\Windows\.

4. Indicators of Compromise (IoCs):

   • The article provides several IoCs, including hashes and URLs associated with Salat's C2 servers.

5. Detection and Mitigation:

   • To detect and mitigate Salat infections,

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.