Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:50:15 UTC
Home > List all groups > List all tools > List all groups using tool RokRAT
 Tool: RokRAT
Names RokRAT
Category Malware
Type
Reconnaissance, Backdoor, Keylogger, Credential stealer, Info stealer, Exfiltration,
Downloader
Description
(Carbon Black) ROKRAT is a Remote Access Trojan (RAT). ROKRAT provides
attackers with numerous capabilities to introduce additional tools and malware onto a
network, exfiltrate data, harvest credentials, as well as capture screenshots of the victim
system. The latest variants of ROKRAT use internet cloud solutions such as PCloud,
Dropbox, and Yandex as a command and control (C2) channel.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 21 June 2023
Download this tool card in JSON format
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1339c5d9-ed14-42ef-b70d-58de896c5d42
Page 1 of 2

All groups using tool RokRAT
Changed Name Country Observed
APT groups
  Reaper, APT 37, Ricochet Chollima, ScarCruft 2012-Mar 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1339c5d9-ed14-42ef-b70d-58de896c5d42
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1339c5d9-ed14-42ef-b70d-58de896c5d42
Page 2 of 2