The Reveal Platform
Intel Name: Neptune rat (mason rat) version 5.3 spread through js files
Date of Scan: June 13, 2025
Impact: Medium
Summary: A new version of Neptune RAT, version 5.3, has been observed in the wild as early as May 27, 2025. Developed by the Mason Team, this RAT is also referred to as MasonRAT based on configuration data from our analysis. The infection begins with a JavaScript (.js) file that executes via wscript.exe when double-clicked. This .js file drops a .bat file onto the disk, while subsequent payloads run directly from system memory without being saved to disk.
