Rat-Wave | Advanced Method

So, recently I was ratted by an advanced new method and then proceeded to lose 500$ because of it and lose every account I can name.

---

                                                                          The Method

The method is simple for the attacker to perform but easy for the victim to be manipulated. First, someone will get ratted and that person's social media and Discord will be compromised, once that's done. This person that got ratted will send the same rat to all their close friends, boyfriend/girlfriend, family members, etc. Now once that's done, if a victim falls for it, the attacker will look around the PC for any important files, PayPal logins, social media, and steal those important accounts. Using those accounts, he'll continue repeating it.

 

The scariest thing is the attacker actually reads your conversation to find a reason for them to download the file, for me. It was an exploit me and my friend made, my friend sent me the RAT and said it was an updated version for it and I trusted my friend.

---

                                                                          Information

After some scanning, I found the RAT but renamed on my USB plugged in. Probably from the attacker hoping I'd run it thinking I'd be curious but I didn't. Plugged in the USB of my old laptop, ran it, and opened Wireshark. Picked up a DigitalOcean server. 

 

https://gyazo.com/572dbcce476533d726ced1ce48ae7498 

 

It seems to be a DigitalOcean VPS hosted in Canada, normally DigitalOcean would have banned the VPS but they haven't caught on yet which is strange.

 

I proceeded to send a DDoS attack to the server for 8 hours to hopefully cause interruptions for the attackers and give the victims time to respond to their friends that it was a RAT and not to run it.

 

---

                                                                            Protection

Just don't run any files, from friends or anyone you know really unless you confirm it on a call or in real life or do not run any suspicious files.

 

---

                                                              Who is responsible?

So, I did some digging and it's impossible to figure out the origins of this "Rat Wave", I've done a lot of digging and ended up with some usernames that helped make the method but not the actual creator.

 

None of the users are apart of the WeAreDevs forums or anything Roblox related really. 

 

Just in case, if you know any of these users, just know they are probably responsible : 

EyeEnding

DxLate

MattKick

---