ResolverRAT: Emerging Threat Targeting Healthcare and Pharmaceutical

ResolverRAT is a sophisticated memory-resident trojan targeting healthcare and pharmaceutical sectors through localized phishing emails. It evades detection by abusing Microsoft's .NET ResourceResolve system while using encryption and fileless techniques to steal sensitive data.

Breakdown

A newly identified remote access trojan (RAT), ResolverRAT, has emerged in a globally coordinated cyber campaign focusing on healthcare and pharmaceutical organizations. First observed in March 2025 by researchers at Morphisec, ResolverRAT reflects a tactical evolution in how threat actors approach stealth, persistence, and initial access. The campaign begins with highly localized and socially engineered phishing emails designed to evoke urgency and compliance, most often impersonating legal authorities or referencing copyright violations. These emails are carefully written in the recipient’s native language, leveraging regional and cultural familiarity to increase credibility and encourage engagement. Victims who click the malicious link are prompted to download a seemingly legitimate application, including hpreader[.]exe, then silently load the malware into memory using reflective DLL injection. This approach, which avoids direct installation or disk activity, enables the RAT to bypass most traditional endpoint protection systems. The campaign’s targeting of healthcare and pharmaceutical entities underscores the high value of medical research, intellectual property, and regulated patient data, marking this as a high-stakes, data-centric operation.

What distinguishes ResolverRAT from traditional malware families is its advanced memory-resident design and multi-layered obfuscation techniques. Rather than relying on file-based execution, ResolverRAT lives entirely in system memory, leaving minimal forensic artifacts and reducing the chance of detection by antivirus software or behavioral monitoring tools. A key feature of this malware is its abuse of Microsoft’s .NET ResourceResolve event system, typically used for dynamically loading application resources at runtime. ResolverRAT hijacks this mechanism to inject and execute malicious code, camouflaging its behavior within legitimate application activity and circumventing conventional detection methods. Its payload is encrypted with AES-256 and only decrypted at runtime, further complicating static analysis. The malware uses certificate pinning and embedded TLS certificates for command-and-control communications, establishing private, encrypted channels that bypass standard SSL/TLS inspection. Additionally, ResolverRAT implements a chunking strategy for exfiltration, breaking large files into smaller segments and transmitting them intermittently, allowing it to blend into typical network traffic and avoid triggering data loss prevention systems.

ResolverRAT’s tactical sophistication, modular architecture, and shared infrastructure suggest the work of a highly capable threat actor or a well-organized affiliate operation. While no specific attribution has been confirmed, similarities with recent campaigns involving the Rhadamanthys and Lumma malware families point to potential collaboration or shared development resources. These campaigns have frequently targeted healthcare and pharmaceutical entities, where long-term espionage, IP theft, and operational disruption offer significant strategic and economic gains. ResolverRAT’s use of signed executables, memory-only payloads, encrypted communications, and dynamic execution flows shows a deliberate effort to evade endpoint defenses and maintain persistent, covert access. Its fallback infrastructure and randomized beaconing patterns emphasize operational resilience, making it harder for defenders to isolate and shut down malicious activity. The RAT also employs multi-threaded command handling, allowing it to perform several actions simultaneously—from data theft to system surveillance—without crashing or triggering stability alerts. Overall, the malware’s behavior suggests a clear focus on infiltration, silent observation, and eventual data exfiltration from regulated high-value targets.

The broader risk profile of ResolverRAT lies in its combination of stealth, adaptability, and infrastructure independence. Once embedded, it enables attackers to remotely control compromised systems, harvest credentials, and extract sensitive datasets with minimal disruption to daily operations—ensuring longer dwell time and greater damage. Because of its in-memory execution and avoidance of typical system calls, ResolverRAT is often invisible to legacy antivirus tools and even many modern EDR solutions. Its ability to disguise command-and-control traffic, avoid writing to disk, and dynamically inject code positions it as a severe threat in highly regulated environments. This has far-reaching implications for sectors like healthcare and pharma—ranging from exposure to proprietary research and development data to violations of laws such as HIPAA, GDPR, or international export regulations. Reputational damage, compliance penalties, and intellectual property theft are all on the table when malware of this caliber breaches a system. Moreover, the tactics seen here—social engineering tailored by region, runtime payload decryption, and memory persistence—indicate a rising standard among threat actors moving away from mass spam and toward curated targeted infiltration. ResolverRAT sets a precedent for the next wave of quiet, high-impact malware threats designed for sustained espionage in the digital age.

Threat Actor Breakdown

Recommendations

• Restrict Phishing Entry Points: Implement advanced email gateway filtering with language-based and context-aware phishing detection to block localized, socially engineered lures.
• Monitor [.]NET Abuse Patterns: Deploy behavior-based detection rules for [.]NET ResourceResolve event anomalies and reflective DLL loading — especially in high-trust applications like hpreader.exe.
• Inspect Encrypted Outbound Traffic: Implement TLS decryption and certificate pinning inspection at the perimeter to identify abnormal outbound communication tied to embedded or spoofed certificates.
• Enable In-Memory Threat Detection: Leverage memory scanning tools capable of detecting fileless execution, control flow flattening, and AES-decrypted payloads that never touch the disk.
• Trigger-Based Process Isolation: Configure conditional sandboxing or process isolation rules that trigger upon execution of high-risk binaries (e.g., signed but uncommon executables used in side-loading campaigns).

Hunter Insights

ResolverRAT represents a significant evolution in threats targeting high-value healthcare and pharmaceutical organizations, combining sophisticated fileless techniques, memory-resident execution, and .NET ResourceResolve exploitation to evade traditional security controls. Its distinctive technical characteristics—including reflective DLL injection, AES-256 encryption, certificate pinning, chunked data exfiltration, and multi-threaded operations—signal a concerning shift toward stealthier, more resilient malware engineered explicitly for long-term espionage and intellectual property theft. Looking ahead, we can expect this attack methodology to increase across additional sectors with valuable intellectual property, with threat actors likely enhancing ResolverRAT's capabilities to include expanded credential harvesting, supply chain compromise vectors, and potentially ransomware deployment modules—ultimately raising the baseline sophistication required for effective cybersecurity across regulated industries.