{
  "family": "gatak",
  "sample_count": 5,
  "category": "ransomware",
  "description": "Trojan:Win32/Gatak (also tracked by Symantec as Trojan.Zbot/Gatak and sometimes functioning as ransomware) is a highly sophisticated malware family infamous for its targeted attacks on the **healthcare sector**. It is primarily distributed through 'watering hole' attacks on websites offering pirated software and keygens. Once inside a network, Gatak acts as an advanced backdoor, allowing attackers to perform reconnaissance, steal sensitive patient data (PHI), and potentially deploy ransomware across the hospital network.<br><br><b>Understanding Gatak (Healthcare Targeting)</b><br>To an end-user, the initial infection usually occurs when trying to install a cracked software application. For a hospital SOC, a Gatak infection is a 'Code Red' incident. Gatak actors are known for their patience; they will spend weeks mapping the internal network, identifying critical servers housing electronic health records (EHR), and escalating privileges before taking destructive action.<br><br><b>Execution and Evasion Strategies</b><br>Gatak is distributed when a user downloads and executes a malicious software keygen (`T1204.002`). The malware is heavily obfuscated and uses steganography to hide its C2 configuration data within seemingly benign image files (`T1027.003`). Upon execution, it achieves persistence (`T1547.001`) and begins extensive network discovery (`T1046`, `T1016`). It uses advanced process injection techniques to blend in with legitimate system processes (`T1055`). The backdoor allows the attackers to deploy secondary modules, such as credential dumpers (`T1003`) and data exfiltration tools (`T1048`), specifically searching for databases and medical imaging files.<br><br><b>Indicators of Compromise & Impact</b><br>The impact can be catastrophic, leading to massive HIPAA violations, compromised patient care, and full network encryption if ransomware is dropped. Host-based IoCs include EDR alerts for suspicious child processes spawning from downloaded keygens or cracking tools, and unusual registry modifications. Network IoCs include beaconing to known Gatak C2 infrastructure and anomalous lateral movement (SMB/RDP) originating from a non-administrative workstation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027.003",
    "T1055",
    "T1046",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Keygens/Cracks)",
      "tactic": "Execution"
    },
    {
      "id": "T1027.003",
      "name": "Obfuscated Files or Information: Steganography",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint, especially if it resides on a network segment with access to patient databases (EHR) or medical devices.",
    "Conduct a massive hunt across the enterprise for pirated software or keygens, as this is the primary entry vector for Gatak.",
    "Assume domain credentials have been compromised if Gatak has been active on the network; initiate password resets for all affected users.",
    "Perform deep network forensic analysis to determine if patient health information (PHI) was exfiltrated to the attacker's C2 servers."
  ],
  "what_to_avoid": [
    "Do not assume the attack is isolated to a single user downloading a cracked game; Gatak actors are highly skilled at lateral movement and actively seek out critical healthcare infrastructure.",
    "Avoid relying solely on signature-based AV, as Gatak heavily obfuscates its payloads and uses fileless techniques."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}