Agent Tesla

Defending against Agent Tesla

First discovered in 2014, Agent Tesla is an advanced Remote Access Trojan (RAT) that steals data and sensitive information from infected machines. This malware has been active for over seven years and uses screenshots, keyboard logging, and clipboard capture as ways to steal information.

Agent Tesla primarily spreads through phishing emails and has been observed in spear phishing campaigns against different industries including energy, finance, logistics, and government. Once it gains access to a system, it hides its presence by using multiple layers of packing and obfuscation.

Since Agent Tesla hides its presence, it becomes difficult for signature-based detection systems to spot this malware, and it goes on to unpack its core functionalities. Once the core functionality is unpacked, the malware extracts login credentials by searching for browsers installed on your system.

In this video, we talk about what Agent Tesla is, how it spreads, and ways to mitigate this malware. Watch the video to learn more, three minutes is all it takes!