A new malware framework known as NetDooka has been discovered being distributed through the PrivateLoader pay-per-install (PPI) malware distribution service, allowing threat actors full access to an infected device.
This previously undocumented malware framework features a loader, a dropper, a protection driver, and a powerful RAT component that relies on a custom network communication protocol.
The first samples of NetDooka were discovered by researchers at
TrendMicro, who warn that while the tool is still in an early development phase, it is already very capable.
The fact that it’s being distributed through the PrivateLoader malware distribution service reflects this potency, as its authors deemed the malware ready for large-scale deployment.
