A new malware-as-a-service operation is giving lower-skill attackers a full cross-platform toolkit, and it says something important about where file-based attacks are heading in 2026.


Researchers at LevelBlue SpiderLabs have published an analysis of QuimaRAT, a Java-based remote access trojan capable of running on Windows, Linux, and macOS from a single codebase. The finding is notable not because QuimaRAT is a particularly novel implant on its own, but because of what surrounds it. The threat actor behind it is not selling a single piece of malware. They are selling a delivery ecosystem, complete with subscription pricing, a builder, a browser-based loader, and a dedicated payload dropper, all aimed at helping customers get a RAT onto a target machine without tripping the defenses that machine already has in place.

A subscription product, not a one-off tool

According to LevelBlue, QuimaRAT is advertised on a dark web forum as version 2.0, described by its seller as having more than seventy modules, AES-256 encryption, a graphical control panel, and full undetectability claims. Pricing follows a familiar software-as-a-service structure rather than a single flat fee, as the table below shows. That structure mirrors the pricing seen across ransomware builders, phishing kits, and infostealers over the past several years, and it lowers the bar for anyone willing to pay rather than build.

License Term Price
1 month $150
3 months $300
6 months $500
12 months $700
Lifetime $1,200

The seller organizes the offering into four distinct components. Quima Control is the RAT client itself, carrying seventy four modules for Windows and forty six shared modules for macOS and Linux. Quima Builder is a separate toolkit for generating launchers and droppers in formats including XLL, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM, alongside compiled outputs such as JAR, EXE, APP, and SH. Quima Loader is a browser-cache based delivery service, and Quima Dropper focuses specifically on HTML and SVG payload generation. Each piece can be bought and used somewhat independently, which means a customer does not need to understand Java, native persistence mechanisms, or landing page design to run a functional campaign.

Why the browser cache loader deserves attention

Quima Loader is arguably the most interesting piece from a defensive standpoint, because it does not rely on a conventional download at all. An operator uploads an executable payload, chooses a delivery format such as HTA or LNK, and picks a landing page template designed to look like a routine browser prompt, for example a CAPTCHA check or a software update notice. The tool then generates a stager link.

When a victim opens that link, the page quietly fetches the real payload and holds it in the browser cache rather than presenting it directly. The visible download button instead delivers a small, clean loader file that the browser and most antivirus engines have no reason to flag. Once the victim runs that loader, it retrieves the cached payload and executes it, a sequence the seller markets as a way to slip past Windows SmartScreen protections. The malware author’s own pitch on their site captures the intent plainly: the toolset is built around “native execution paths, system-owned resources, clean outputs” so that neither antivirus tooling nor the user notices anything unusual.

What makes this uncomfortable for defenders is how ordinary each step looks in isolation. There is no exploit chain, no memory corruption, no dramatic technical trick. It is a landing page, a cache, a small file, and a user who clicks twice. That is precisely the category of activity that traditional download inspection and signature-based antivirus struggle to catch, because every individual object involved can appear legitimate on its own.

Under the hood: Java, native libraries, and operational discipline

LevelBlue’s technical breakdown shows QuimaRAT built as a modular Java project using Apache Maven, with two separate pom.xml files reflecting that modular structure. The sample researchers examined ran on Java SE 8 and carried embedded Java Native Access libraries for Windows, Linux, and macOS across multiple processor architectures, which lets the RAT reach into lower-level operating system APIs while keeping the portability that Java provides across platforms.

The malware also loads an encrypted configuration file bundled inside its JAR archive, decrypted through a repeating-key XOR routine, that governs environment validation, persistence setup, and command-and-control initialization. Before doing anything else, QuimaRAT checks whether a copy of itself is already running by creating and locking a file in the operating system’s temporary directory using Java’s file locking functionality. If another instance already holds that lock, the new process simply terminates. It is a small detail, but it reflects a level of operational maturity: malware that spawns duplicate processes tends to become noisy and easier for defenders to spot.

Persistence is handled differently depending on the host. On Windows, QuimaRAT can use Registry Run keys, scheduled tasks, or the Startup folder. On Linux, it relies on desktop autostart entries and crontab reboot jobs. On macOS, it installs a LaunchAgent property list. That range means the same operator can maintain footholds across a mixed environment of Windows endpoints, Linux servers, and Mac laptops without needing separate tooling for each.

Command and control built to survive disruption

Once running, QuimaRAT communicates with its command infrastructure over TCP, with WebSocket, TLS, and HTTPS available as alternatives. A watchdog component keeps the connection alive and reestablishes it automatically if contact is lost, and the malware maintains an internal shutdown flag that governs whether it keeps attempting to reconnect. LevelBlue also flagged an optional Pastebin-based mechanism for updating command-and-control hosts, letting an operator rotate infrastructure without rebuilding or redistributing the payload to already-compromised machines.

Static analysis of the sample identified twenty three fully implemented commands alongside two hundred and twelve additional commands defined at the protocol level but not yet active in code, a gap that suggests the platform is built for future expansion through downloaded modules, uploaded binaries, or fileless payloads rather than a fixed feature set. Confirmed capabilities already include remote command execution, payload and plugin delivery, credential theft, file transfer, clipboard access, webcam surveillance, and fileless shellcode execution on Windows systems. LevelBlue summarized the overall design succinctly, describing QuimaRAT as a modular platform rather than a single static implant, built with obfuscation and symbol relocation techniques that let it rotate its fingerprint without changing what it actually does.

The real product is the packaging, not the RAT

None of QuimaRAT’s individual techniques are unprecedented. What stands out is the business model wrapped around them. A buyer does not need to write a RAT, design a phishing landing page, or research operating system persistence. They rent access to a suite that already handles all of it, and they can swap delivery formats depending on what a target environment is likely to trust that week. A campaign built around a fake CAPTCHA page today can shift to a disguised shortcut file or a macro-enabled document tomorrow, using the same underlying client and the same subscription.

That flexibility is exactly why the file itself, whatever form it happens to take, remains the most consistent point of failure across the entire attack chain. The RAT’s post-compromise capabilities are serious, but none of them matter until a script, a shortcut, a document, or a browser download has already been trusted and executed.

Where FileDNA CADR fits

Content Analysis, Disarm and Reconstruction technology (CADR) is built for exactly this kind of threat, because QuimaRAT’s entire delivery model runs through files, scripts, shortcuts, and browser-served containers rather than a single fixed exploit. FileDNA does not wait for a RAT process to establish a command channel before acting. It inspects incoming objects, including high-risk formats such as VBS, JS, BAT, LNK, XLL, DOCM, XLSM, CHM, CPL, HTML, and SVG, at the content level, strips embedded active logic and executable structures, and reconstructs a clean version of the file before a user ever has the chance to open it. Because that approach targets the underlying pattern, active content hidden inside a trusted-looking container, rather than a specific malware signature, it holds up even as operators like the one behind QuimaRAT rotate formats, loaders, and landing page templates. FileDNA CADR does not replace endpoint detection, sandboxing, or email security. It closes the gap those tools leave open by removing the malicious object from the delivery chain before execution ever becomes a decision the user has to make correctly.

QuimaRAT is best understood as a file-driven delivery platform that happens to end in remote access, rather than a remote access trojan that happens to need delivery. The builder, the loader, the dropper, and the cross-platform packaging are the actual product being sold. Remote access is simply what the buyer gets once one of those files does its job.

References