No rest for the wicked: HiatusRAT takes little time off in a return to action

Executive Summary  

 In March 2023, Lumen Black Lotus Labs reported on a complex campaign called “HiatusRAT” that infected over 100 edge networking devices globally. The campaign leveraged edge routers, or “living on the edge” access, to passively collect traffic and functioned as a covert network of command and control (C2) infrastructure.  

 After publishing our initial research, Black Lotus Labs continued to track this actor resulting in new malware samples and infrastructure associated with the HiatusRAT cluster. In the …

access action black lotus black lotus labs called campaign collect covert devices edge executive hiatusrat labs lumen march network networking rest return routers the edge traffic