Approach of an Active Defense Protocol to Deal with RAT Malware

Abstract

Organizations have become infrastructure and information dependent, and any problem that affects those assets can compromise the organization’s operations. Incident handling and malware research requires new strategies focusing on cyber defense in a way that allows researchers, incident responders and authorities to react preventively to mitigate high damaging attacks. The results of this research are a guideline of an active defense protocol to contain Remote Access Trojan (RAT) malware attacks, identifying proactively weaknesses on generic, open source or leaked code used for Trojan infection campaigns, and thus developing an effective response protocol to contain and stop the threat with a limited resource investment. This protocol does not replace traditional national protocols required by local authorities to report cyber security incidents; however, some mechanisms to deactivate Command and Control (C2) servers, can reduce effectiveness of operations based on malware related threats faced in Colombian and other countries around the globe.