Proactive Defence Against Rhadamanthys and PyStoreRAT

Du'aine Davis

Observed in the wild

• A recent campaign involving Rhadamanthys and PyStoreRAT malware has targeted organisations globally, focusing on Linux systems and enterprise environments. The attack was observed in late 2025, aiming to infiltrate networks and exfiltrate sensitive data while maintaining persistence.
• The threat actors leveraged modular malware architecture, GitHub-hosted clusters, and advanced evasion techniques. PyStoreRAT uses adaptive exposure management and anti-ransomware bypass strategies, exploiting weak endpoint defences and remote code execution vulnerabilities.
• Organisations should enable Microsoft Defender for Endpoint with advanced hunting queries to detect suspicious GitHub traffic and RAT behaviours. Monitor for anomalous process injections and network flows linked to Rhadamanthys modules. Apply strict Linux hardening, patching, and behavioural-based detection rules to block persistence mechanisms.

PyStoreRAT: A New AI-Driven Supply Chain Malware Campaign Targeting IT & OSINT Professionals  | Morphisec Blog