A newly discovered Remote Access Trojan (RAT) for Linux has been seen targeting telecommunications firms in Thailand as reported by Group-IB. Named RAT Krasue in reference to a Thai nocturnal spirit, this malware is quite dangerous to those networks it has infected. What is notable about this RAT is that it has been undetected on the infected networks since 2021, much longer than many campaigns are capable of. It has been able to accomplish this through a multitude of factors, some of which include UPX packing to both obfuscate the code and make the size of the malware smaller. It can also run itself as a background process and install additional rootkits based on the user’s permissions. Additionally, it uses fake metadata to rename itself as various VMWare applications and programs to further avoid suspicion. RAT Krasue uses a designated IP as the master command-and-control (C2) server and uses the Real Time Streaming Protocol (RTSP) to send signals back to the C2 server without arousing suspicion. This protocol is typically used for applications such as video streaming to endpoint devices. One of the more novel approaches to hiding the malware has been to hijack the ‘kill()’ system call so it cannot be used against any of the malware processes and can be used to direct the rootkit via parameters passed to the ‘kill()’ call. This allows the threat actors to interact with the malware without raising alarm. Researchers also believe that the code for Krasue appears to be based on the rootkits Diamorphine, Suterusu, and Rooty. CTIX analysts will continue to monitor the effects of Krasue on telecommunication firms.