Skitnet Malware: How Ransomware Gangs Execute Stealthy Data Theft | 2025 Alert

Skitnet Malware: The Rising Threat Empowering Ransomware Gangs’ Stealthy Data Theft Operations

In the ever-evolving landscape of cybersecurity threats, a sophisticated new malware called Skitnet has emerged as a powerful weapon in ransomware gangs’ arsenals. This versatile tool enables cybercriminals to silently steal sensitive data and maintain persistent remote access to compromised systems. As organizations struggle to defend against increasingly complex attacks, understanding Skitnet’s capabilities and operational methods has become essential for cybersecurity professionals worldwide.

What is Skitnet Malware?

Skitnet Malware (also known as Bossnet) represents a concerning evolution in malware development. First advertised on underground forums like RAMP on April 19, 2024, this multi-stage malicious tool has rapidly gained popularity among various ransomware operators. Developed by a threat actor tracked under the codename LARVA-306, Skitnet Malware is marketed as a “compact package” comprising both server components and the malware itself.

What sets Skitnet Malware apart from conventional malware is its sophisticated design using multiple programming languages and evasion techniques. The malware creators have leveraged both Rust and Nim programming languages—relatively uncommon choices that help the malware avoid detection by traditional security solutions that primarily focus on C/C++ or .NET-based threats.

Since its emergence on dark web marketplaces, Skitnet has transformed from merely another malware offering to a preferred tool for established ransomware gangs. Its adoption has accelerated dramatically in early 2025, with cybersecurity researchers observing its deployment across multiple high-profile ransomware campaigns.

Technical Architecture and Capabilities

Skitnet Malware’s technical sophistication is evident in its multi-layered architecture. The initial executable is a Rust binary that serves as the first stage of the attack. This component’s primary function is to decrypt and execute an embedded payload that’s compiled in Nim, another programming language growing in popularity among malware developers for its cross-platform capabilities and lower detection rates.

The Nim-based component acts as the operational core of Skitnet, establishing a reverse shell connection with command-and-control (C2) servers using an unusual communication method: DNS tunneling. This technique allows the malware to hide its communication within DNS queries, which are typically less scrutinized by security monitoring tools compared to HTTP or direct TCP connections.

To further avoid detection, Skitnet employs sophisticated API handling techniques:

• Uses GetProcAddress function to dynamically resolve API function addresses
• Avoids traditional import tables that would create recognizable signatures
• Implements multi-threaded operations for continuous but stealthy communication

The malware maintains persistence through multiple mechanisms and offers an impressive range of capabilities, including:

1. Data exfiltration commands
2. Remote access functionality
3. Screen capture abilities
4. Deployment of legitimate remote desktop software (like AnyDesk)
5. Security product reconnaissance
6. The ability to download additional .NET loader binaries for further payloads

This versatility makes Skitnet an all-in-one post-exploitation tool that gives attackers persistent access and extensive control over compromised systems.

Attack Vector and Operational Methods

Once installed on a victim’s system, Skitnet Malware operates with remarkable stealth. The malware initiates multiple threads to:

• Send DNS requests every 10 seconds
• Read DNS responses and extract commands
• Execute the commands on the compromised host
• Transmit execution results back to the C2 server

This communication happens via a control panel that allows attackers to manage all infected hosts remotely. The command set exposed through this interface is comprehensive, enabling operators to perform numerous malicious actions.

Some of the supported PowerShell commands include:

• Startup: Creates shortcuts in the victim’s Startup directory to ensure persistence across system reboots
• Screen: Captures screenshots of the victim’s desktop for surveillance or information gathering
• Anydesk/Rutserv: Deploys legitimate remote desktop software like AnyDesk or Remote Utilities (“rutserv.exe”) for interactive access
• Shell: Executes PowerShell scripts hosted on remote servers and returns the results to the C2
• AV: Gathers information about installed security products to help attackers evade detection

These capabilities provide ransomware operators with extensive visibility into compromised environments, allowing them to move laterally, exfiltrate valuable data, and maximize the impact of their attacks.

Real-World Ransomware Deployments

Security researchers have observed multiple ransomware groups adopting Skitnet Malware as part of their criminal operations. According to Swiss cybersecurity company PRODAFT, the Black Basta ransomware group has been particularly notable in their use of Skitnet.

In April 2025, Black Basta leveraged Skitnet in Teams-themed phishing campaigns targeting enterprise environments. These attacks used social engineering tactics centered around Microsoft Teams messaging to trick employees into executing the initial Skitnet payload. Once established, the malware provided Black Basta operators with the access needed to deploy their ransomware payload after exfiltrating sensitive data.

The rapid adoption of Skitnet Malware by established ransomware gangs indicates its effectiveness and reliability. With its stealth features and flexible architecture, security experts believe Skitnet is gaining significant traction within the ransomware ecosystem, potentially becoming a standard component in the ransomware-as-a-service (RaaS) market.

Detection and Prevention Strategies

Detecting and preventing Skitnet Malware infections requires a multi-layered security approach. The malware’s use of uncommon programming languages like Rust and Nim, combined with its DNS-based command and control mechanism, creates unique challenges for traditional security solutions.

Organizations should:

1. Implement DNS monitoring to detect suspicious DNS query patterns
2. Deploy endpoint detection and response (EDR) solutions capable of identifying unusual process behaviors
3. Utilize application whitelisting to prevent unauthorized executables from running
4. Maintain regular security awareness training focusing on phishing detection
5. Implement network segmentation to limit lateral movement opportunities
6. Regularly update security tools to include the latest Skitnet Malware detection signatures

Security teams should pay particular attention to DNS traffic patterns, as Skitnet’s 10-second communication intervals may create recognizable patterns that can be identified through proper monitoring.

The Broader Threat Landscape

Skitnet Malware’s emergence coincides with other developments in the malware ecosystem. The same report that detailed Skitnet also mentioned TransferLoader, another sophisticated malware being used to deliver the Morpheus ransomware strain. Active since February 2025, TransferLoader uses a three-component architecture and leverages the InterPlanetary File System (IPFS) as a fallback communication channel.

These parallel developments highlight how the ransomware ecosystem continues to evolve, with threat actors constantly developing new tools and techniques to evade detection and maximize profits. The commercialization of these tools through underground forums further democratizes access to sophisticated attack capabilities, enabling less technically skilled criminals to conduct devastating attacks.

Protecting Your Organization

In light of the Skitnet Malware threat and similar emerging malware, organizations should:

• Ensure all systems are patched and updated regularly
• Implement strict email filtering to prevent phishing attempts
• Deploy DNS-level security controls to detect unusual patterns
• Conduct regular security assessments focused on detecting post-exploitation tools
• Maintain comprehensive and tested backup solutions
• Develop and practice incident response plans specific to ransomware attacks
• Consider zero-trust architecture implementations to limit the impact of compromised credentials

The sophistication of tools like Skitnet Malware underscores the importance of assuming breach mentality—organizations must not only try to prevent initial access but also implement controls that can detect and contain threats that have already established a foothold.

Strengthen your organization’s defenses against Skitnet Malware attacks by implementing our recommended security measures today. Contact our cybersecurity experts for a customized protection assessment.