Hacking Cat Uses Gorilla RAT and Monkey Ransomware in Destructive Exchange Attacks

Hacking Cat strikes Russian organizations

According to Kaspersky research, flagged as critical in a technical digest published on dev.to, a threat group tracked as Hacking Cat is running active intrusions against Russian organizations. The Record, which reported on the findings, describes the actors as pro-Ukraine hackers using newly developed malware. The campaign stands out for combining remote access tooling with ransomware built to encrypt or outright destroy data across Windows, Linux and VMware ESXi systems.

From Exchange compromise to destruction

In the attack flow reconstructed by Kaspersky, intruders first abuse vulnerabilities in internet-facing Microsoft Exchange servers to gain a foothold. From there they drop Gorilla RAT, a remote access trojan that reaches its command-and-control server over a WebSocket connection. Using file and process operations plus TCP tunneling, the operators relay connections from the compromised Exchange host into internal services, effectively turning the mail server into a pivot point deeper into the network.

Once positioned, they deploy Monkey ransomware in a variant matched to the target operating system. Behavior differs between variants: some encrypt files, some destroy data, and some clear logs, and not every behavior appears in every incident. The dev.to writeup lists CVE-2021-26855 and CVE-2026-42897 in connection with the Exchange entry point but stresses these are candidate estimates only, warning investigators not to scope their work around any single CVE.

What Gorilla RAT and Monkey do

Gorilla RAT gives attackers remote control, file transfer and the ability to tunnel TCP traffic toward internal assets. The writeup notes that a simpler reverse shell appears to have preceded it, leaving Run-key persistence behind, and that beaconing at an interval of roughly 27 to 36 seconds has been observed, though that interval alone is not sufficient to identify the malware.

Monkey ransomware ships in variants for Windows, Linux and ESXi. Kaspersky's observational data, as summarized by the writeup, confirms execution of both Gorilla RAT and Monkey across multiple incidents, along with the follow-on encryption, destruction and log deletion. One especially harsh detail: some Rust-written variants never save decryption keys, leaving the damage unrecoverable. The writeup also associates Nemo Wiper and ClearWater with the group's toolkit.

What victims and administrators can see

Victims typically discover the intrusion only after the fact, through inaccessible files and ransom notes. For administrators, the dev.to analysis, which marks its detection guidance as inference rather than confirmed fact, suggests starting with suspicious process execution or outbound WebSocket traffic on Exchange servers, then watching for service stops, cleared Windows event logs and mass file modifications. Correlating execution on Exchange, WebSocket connections, subsequent internal connections, and encryption or log wiping on secondary hosts by host, account and timestamp can reconstruct the intrusion path. Because the attackers deliberately delete logs, and because Linux and ESXi auditing is often thin, the writeup recommends leaning on centrally stored logs and network records and cross-referencing the indicators Kaspersky has published.

Recommended defenses

The writeup's mitigation list is straightforward: patch Exchange and remove unnecessary public exposure, treat credentials as potentially compromised and rotate them, apply application control and network segmentation to limit RAT deployment and lateral movement, and keep isolated offline backups whose recovery is actually verified. Containment involves isolating compromised hosts, blocking relayed traffic, and protecting backups before recovery work begins.

Why it matters

This campaign illustrates a shift from pure extortion toward destructive attack. Variants that discard decryption keys leave no path to recovery regardless of ransom negotiation, and the targeting of ESXi means hypervisor-level encryption can cripple many virtual machines in one stroke. The initial access vector, a perimeter-facing Exchange server, remains common in enterprises, and the operators compound the damage by erasing logs and backups to frustrate both investigation and restoration. Organizations running exposed Exchange servers, particularly where virtualization or backup infrastructure is reachable from them, should take this as a prompt to patch, segment and retest their recovery procedures.