New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

1. Executive summary

LevelBlue researchers have disclosed QuimaRAT, a novel Java-based remote access trojan offered as a malware-as-a-service (MaaS) product targeting Windows, Linux, and macOS. The full tool suite — comprising the RAT, a multi-format builder, a browser-cache loader, and an HTML/SVG dropper — is priced from $150/month to $1,200 for lifetime access and is designed for cross-platform deployment using native OS trust mechanisms to evade detection. The RAT features a modular plugin architecture with 74 Windows and 46 macOS/Linux modules, enabling dynamic capability expansion via encrypted C2-delivered plugins. EMEA financial services should treat this as an emerging initial-access and persistence threat, particularly relevant where employee endpoints or development/test environments run Java workloads across operating systems.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	QuimaRAT is a modular RAT with persistence, C2, and plugin delivery capabilities — detection on a managed endpoint constitutes an ICT-related incident requiring a defined response process.	Ensure incident runbooks cover Java-based cross-platform RAT discovery, including isolation, forensic capture, and plugin artifact recovery.
DORA Art. 18: classification of ICT-related incidents and cyber threats	A QuimaRAT infection introduces remote access, data exfiltration, and persistence capabilities that must be classified by impact severity.	Pre-classify RAT-detection scenarios so triage teams can assign severity without delay.
DORA Art. 24: digital operational resilience testing — general requirements	The QuimaRAT loader explicitly bypasses Windows SmartScreen and uses native execution paths to evade AV; resilience testing should validate endpoint controls against this technique.	Include browser-cache loader delivery and JAR/EXE execution paths in purple-team or adversary-emulation exercises.
NIS2 Art. 21(2)(d): supply chain security measures	The MaaS model lowers the barrier for threat actors to purchase and deploy QuimaRAT; supply-chain vectors (phishing via fake CAPTCHA/update lures, malicious document macros) are the likely delivery path.	Review email gateway and web-content filtering controls for HTA, LNK, DOCM, XLSM delivery vectors.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties	OES and RDSP operators detecting QuimaRAT on in-scope systems must consider whether the incident meets reporting thresholds.	Ensure SOC playbooks reference UK NIS reporting obligations for RAT-related compromises.

3. Technical analysis & attack chain

Confirmed attack chain (Quima Loader delivery path)

Stager link delivery. The operator uses the Quima Loader panel to upload an EXE payload, select a delivery format (HTA or LNK), and choose a landing page template (fake CAPTCHA check or fake software update alert). A stager link is generated and sent to the victim.
Browser cache payload staging. The victim opens the stager link in a browser. The landing page loads and the payload is fetched and held in browser cache.
Loader download. A "Download" button appears on the page. Clicking it saves a small, clean loader file that is trusted by the browser.
Payload execution. The victim runs the loader, which reads the cached payload from browser cache and executes the main payload on the system. On Windows, this process is designed to bypass SmartScreen protections.

Additional delivery vectors (Quima Builder / Quima Dropper)

Quima Builder can generate payloads in JAR, EXE, APP, SH, BAT, and VBS formats, as well as XLL, LNK, JS, DOCM, XLSM, MSC, CPL, and CHM formats — enabling diverse delivery scenarios including malicious Office documents and Excel add-ins.
Quima Dropper functions as an HTML/SVG payload generator.

Malware architecture and capabilities

Language/build: Modular Java project built with Apache Maven. Embeds Java Native Access (JNA) native libraries for Windows, Linux, and macOS across multiple architectures, enabling direct interaction with low-level OS APIs via C/C++ code.
Configuration: Decodes and parses an internal configuration file for environment validation, persistence installation, and C2 initialisation.
Single-instance enforcement: Creates a lock file in the OS temporary directory to ensure only one instance of the trojan runs at a time.
Modules: 74 Windows modules and 46 macOS/Linux modules. Specific module capabilities beyond screen capture and input control (explicitly named for macOS) are not detailed in the source material.
Plugin system: Supports dynamic capability expansion through encrypted plugins delivered, loaded, unloaded, and updated from C2 infrastructure.
Stealth: On Windows and Linux, the seller claims complete stealth with no visible UI elements or desktop entries. On macOS, screen capture and input control require user-granted admin permissions.
C2: C2 infrastructure is used for plugin delivery and initialisation; specific C2 protocols, ports, or infrastructure details are not provided in the source material.

Confidence caveat: All technical detail above is sourced exclusively from LevelBlue's analysis as reported by The Hacker News (single-sourced; verify before enforcement). No CISA-KEV entry, no CVE, and no MITRE ATT&CK technique IDs are associated with this item in the verified reference data. No named threat actor attribution is provided — attribution is unconfirmed. No IOCs (hashes, domains, IPs, or file names beyond the tool names) are present in the source material.

4. Mitigation & containment

P1 — Within 24 hours

EDR / AV tuning: Add detection logic for Java processes spawning from browser cache directories or executing from temporary directories. Flag java.exe / java processes creating lock files in temp directories as suspicious.
SmartScreen bypass awareness: The loader is designed to bypass Windows SmartScreen. Do not rely on SmartScreen as a control for this threat. Ensure EDR is the primary endpoint detection layer.
Email gateway blocking: Block or quarantine attachments and links delivering HTA, LNK, VBS, JS, BAT, DOCM, XLSM, MSC, CPL, and CHM file types from external senders, consistent with the Quima Builder output formats.
Web content filtering: Block known fake CAPTCHA and fake software update landing page patterns. If specific URLs become available, block at the web proxy.

P2 — Within 72 hours

Java execution policy: Restrict Java runtime execution on endpoints to approved applications. Where JAR execution is not a business requirement, disable the Java association for .jar files via AppLocker or equivalent application control.
Browser cache monitoring: Monitor for unusual executable content in browser cache directories. Consider deploying EDR rules that flag EXE or DLL files written to and subsequently executed from browser cache paths.
JNA library detection: Scan for Java processes loading JNA native libraries in non-standard Java application directories. Legitimate JNA usage typically occurs within known Java application paths.
Office macro controls: Ensure macros are disabled by default for Office documents from external sources (DOCM, XLSM are supported builder formats). Enforce via GPO or MDM.

P3 — Within 7 days

Purple-team exercise: Emulate the Quima Loader delivery chain (fake update page → browser cache staging → loader execution) to validate endpoint detection coverage and incident response playbooks.
Threat hunt: Hunt for Java processes with network connections to unknown endpoints that exhibit beaconing behaviour, particularly on systems where Java is not a standard runtime.
Endpoint hardening: On macOS endpoints, ensure Screen Recording and Accessibility permissions are restricted to approved applications only, since QuimaRAT requires these for screen capture and input control.

5. Indicators of compromise

No indicators of compromise available in the source material. The source does not provide file hashes, domains, IP addresses, file paths (beyond "OS temporary directory" for the lock file), or C2 infrastructure details.

6. Detection

rule QuimaRAT_Java_RAT {
  meta:
    author = "Adverse Trace"
    date = "2026-07-06"
    reference = "https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html"
    description = "Detects QuimaRAT Java-based cross-platform RAT based on tool names and builder output formats"
  strings:
    $name1 = "QuimaRAT" nocase
    $name2 = "Quima Control" nocase
    $name3 = "Quima Builder" nocase
    $name4 = "Quima Loader" nocase
    $name5 = "Quima Dropper" nocase
    $config = "internal configuration" nocase
    $jna = "jna" nocase
    $maven = "maven" nocase
  condition:
    3 of them
}

title: QuimaRAT Loader Execution from Browser Cache
id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c
status: experimental
description: Detects execution of a loader process that reads a payload from browser cache, consistent with Quima Loader delivery chain
author: Adverse Trace
date: 2026/07/06
references:

  - https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html
logsource:
  product: windows
  category: process_creation
detection:
  selection_browser_cache:
    CommandLine|contains:

      - "\\AppData\\Local\\Microsoft\\Windows\\INetCache"
      - "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache"
      - "\\AppData\\Local\\Mozilla\\Firefox\\Profiles"
  selection_temp_lock:
    CommandLine|contains:

      - "temp"
    Image|endswith:

      - "java.exe"
      - "javaw.exe"
  condition: selection_browser_cache or selection_temp_lock
falsepositives:

  - Legitimate Java applications using browser cache or temp directories (rare)
level: high

7. Sources

The Hacker News, "New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS," https://thehackernews.com/2026/07/new-java-based-quimarat-maas-built-to.html, 2026-07-06

8. Adverse Trace position

Severity: Medium. QuimaRAT is a capable, cross-platform modular RAT with a mature MaaS delivery model, but there is no evidence of active exploitation in the wild, no associated CVE, and no confirmed threat actor attribution — all technical detail is single-sourced from LevelBlue via The Hacker News. For EMEA financial services, the primary risk is initial access via social engineering (fake CAPTCHA/update lures) followed by persistent remote access on employee endpoints, including macOS devices where Java is present. The browser-cache loader technique and SmartScreen bypass are operationally relevant and should be validated against current endpoint controls. We will monitor for IOC publication, C2 infrastructure identification, and any evidence of active deployment targeting financial sector organisations.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.