How to protect yourself against ResolverRAT and new invisible threats?

A new malware has just appeared in the cyberthreat landscape: ResolverRAT. This Remote Access Trojan (RAT) stands out for its ability to hide in memory, adapt dynamically to its environment, and use evasion techniques never seen before.

ResolverRAT: a stealthy and sophisticated malware

Why should this threat be taken seriously?

  • In-memory execution only: ResolverRAT's payload (the malicious load injected into the information system, which can lie dormant for several months before triggering an attack) never touches the disk, making its deployment extremely difficult to detect
  • Encryption and compression of its payload: Thanks to AES-256 encryption combined with GZip, this malware conceals its intentions while evading static analysis
  • Injection via .NET Resource Resolver: This innovative technique allows ResolverRAT to bypass security solutions that monitor Win32 calls (an API used notably to communicate with the system) and standard file operations. A real masterstroke to avoid detection

How does this RAT spread?

It starts with a sophisticated phishing campaign, using messages in several local languages (Hindi, Italian, Turkish, etc.) to lure victims into downloading a malicious file.

Using the DLL side-loading technique (a dynamic software library that loads resources into memory as needed) with a legitimate file (hpreader.exe), it triggers the infection stealthily, bypassing traditional security.

Rock-solid persistence

ResolverRAT does not just infect the system: it sets up multiple persistence through obfuscated registry keys (made harder for detection systems to understand), and installs itself in strategic directories such as AppData or Program Files.

All of this with fallback mechanisms (alternatives in case of failure) to ensure it remains active, even if some methods fail.


On the network side, the attack is just as sophisticated

  • Communication via custom protocols: Use of standard ports but with a custom communication protocol to blend into legitimate traffic
  • Embedded certificate validation: The malware sets up a certificate validation system that renders SSL/TLS traffic monitoring completely ineffective
  • Evasion through intermittent connections: Random connections and data exchanged in chunks make any detection through traffic analysis virtually impossible

Why is this worrying?

ResolverRAT represents a major evolution in the way attackers bypass conventional security solutions. This malware shows that behavioral prevention and detection are more essential than ever to defend against these invisible threats.

In this context, if detective and preventive measures have failed, a corrective measure such as backup (and of course restore) can be the last line of defense against disaster ...

Backup, essential against malware attacks

Thus, as attacks become stealthier and more destructive, data backup is an indispensable resilience tool to:

  • Quickly restore compromised data in the event of an infection.
  • Limit the economic impact of an attack (data loss, business shutdown, extortion).
  • Guard against ransomware that blocks access to files.
  • Ensure business continuity without giving in to cybercriminals.

Indeed, in the event of infection by a RAT such as ResolverRAT, it is often impossible to guarantee the integrity of the contaminated systems. And often, only a restore from a clean backup makes it possible to start again on a reliable basis.

How to implement an effective backup against malware

For a backup to be truly useful against sophisticated threats, it must meet several criteria:

  • Offsite storage: store backups offline or in a secure cloud to prevent them from being encrypted by malware themselves.
  • Regular and automated backups to limit data loss between two attacks.
  • Multiple versions: keeping several historical versions makes it possible to restore to a point before the date of infection.
  • Backup encryption to guarantee their confidentiality even in the event of unauthorized access.
  • Regular restore tests to verify that backups are actually usable in a crisis.

The 3-2-1 strategy (3 copies, 2 different media, 1 off-site) remains a benchmark for withstanding modern cyberthreats.

Protecting yourself against new threats for the long term

With the emergence of malware like ResolverRAT, relying solely on prevention is no longer enough. The ability to quickly restore your systems has become a pillar of cybersecurity.

Investing in certified professional backup solutions and integrating backup into your incident response plan is now essential to protect the long-term viability of your business.