Malicious Packagist packages disguised as Laravel utilities install an encrypted PHP RAT via Composer dependencies, enabling remote access and C2 callbacks.

Socket's Threat Research Team identified a RAT distributed across multiple Packagist PHP packages by threat actor nhattuanbl. Two packages (lara-helper and simple-queue) contain identical RAT payload in src/helper.php file. A third package (lara-swagger) automatically pulls in the RAT via Composer dependency. The payload uses three-layer obfuscation: goto spaghetti control flow, hex/octal string encoding, and randomized identifiers. Once loaded, it spawns detached background process, connects to C2 server at helper.leuleu.net:2096 using encrypted AES-128-CTR communication with hardcoded key 'esCAmxUoJkIjTV0n'. The RAT performs system reconnaissance, supports remote shell execution, file upload/download, screenshots, and provides persistent backdoor access. It uses lock file mechanism to prevent multiple instances and retries C2 connection every 15 seconds indefinitely.