Deepwatch 
TL;DR
Deepwatch identified a second campaign involving FirmRAT, an emerging Windows remote access trojan first documented by Deepwatch in July 2026. This version arrives through ClickFix, installs alongside genuine SonicWall Global VPN Client software, and uses a modified signed library to trigger malicious code from a trusted process. The underlying framework remains recognizable, but its delivery, execution, and capabilities have all matured.
Deepwatch now tracks the family as FirmRAT. It has returned with a new disguise and a more polished execution chain.
In July 2026, Deepwatch published an analysis of a newly observed Windows remote access trojan delivered through ClickFix and executed inside an IBM SPSS process. The malware stood out for its custom interpreter, domain specific language, broad anti analysis coverage, and a previously undocumented AMSI bypass. It also appeared unfinished. Several execution paths were still stubs that suggested active development. A second campaign observed in September now shows how quickly that development is progressing.
The new sample preserves the same core framework, tasking language, encryption patterns, and anti-analysis features. What changed is how the operators package and launch it. The first campaign used the grafted import technique through an IBM SPSS library. This version applies the same technique more discreetly inside genuine SonicWall software, allowing a trusted application to initiate the malicious execution chain. The result is a more convincing package that is harder to distinguish from legitimate enterprise software.
ClickFix Delivers a Convincing VPN Package
The attack began with a fake verification page that instructed the victim to paste a command into the Windows Run dialog. The command launched msiexec.exe and retrieved a remote package presented as SonicwallSwgManager.msi.
The 20 MB MSI bundled the complete SonicWall Global VPN Client suite with a legitimate permissions auditing application and the malicious implant files. A standard installer action then launched SWGVC.exe, the genuine, signed SonicWall VPN client. The package is designed to look routine, with authentic vendor software and a signed SonicWall launcher providing cover for the implant. The deception becomes visible one layer deeper.
A Grafted Import Turns Vendor Code Into the Trigger
The attackers modified an authentic SonicWall library while leaving its embedded vendor certificate in place. Although a full signature check reveals that the file no longer matches its signed digest, Windows does not automatically perform that validation when an application loads a dependency.
Inside the library, the operators replaced a legitimate import with a reference to their implant. The change was carefully designed to preserve the import table’s existing size and structure, making the tampering less obvious during an initial review.
The result is particularly notable. Original SonicWall code calls through the modified import during normal application activity, turning a legitimate feature into the trigger for malicious execution. The first FirmRAT campaign added a new import to an IBM library. This version replaces an existing one, showing that the operators are refining the grafted import technique to blend more naturally into trusted software.
Four Stages Keep the RAT in Memory
Once triggered, the implant decrypts an embedded shellcode stage and transfers execution through a legitimate Windows callback mechanism. The next stage searches for an encrypted container that holds both the operator’s deployment instructions and the final FirmRAT payload.
Those instructions are written in the family’s custom scripting language. They establish and repeatedly reapply persistence, load the final payload directly into memory, and keep the process available for future tasking.
FirmRAT supports more than twenty command families covering host reconnaissance, registry and service management, HTTP requests, persistence, code execution, and command and control. The second sample also adds several command groups, showing that development has continued since the first campaign.
Why FirmRAT Matters
FirmRAT is a prime example of how grafted imports can be weaponized to turn software an organization already trusts into a path for malicious execution. By altering the application’s import structure, the operators cause Windows to load the implant as though it were a required component. The malicious chain then begins through code already present in the SonicWall application. To security tools and analysts, the parent process, publisher, and execution lineage may still appear legitimate even though the application has been redirected to code controlled by the attacker.
The move from an added import in the first campaign to a replaced import in the second shows that the technique can be adapted across different software packages. The campaigns were observed in separate customer environments and industry sectors. That is not enough evidence to identify a targeting pattern or attribute the activity to a particular actor. It does show that the operators can reuse the same malware framework while changing the trusted software wrapped around it.
For security teams, a signed parent process should not end an investigation. Signature validation results, unexpected dependencies, unsigned modules loaded by trusted applications, installer context, persistence activity, and unusual callback execution can expose the trust gap that grafted imports exploit.
The full technical report maps the modified import, traces all four stages of the execution chain, and documents FirmRAT’s expanded capabilities. It also includes YARA rules and indicators of compromise that detection teams can adapt for further analysis.
To read the full report, click here
↑
Share