Orcus RAT - Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 15:53:37 UTC
Home > List all groups > List all tools > List all groups using tool Orcus RAT
 Tool: Orcus RAT
Names
Orcus RAT
Orcus
Schnorchel
Category Malware
Type Backdoor, Keylogger, Credential stealer, Info stealer, DDoS
Description
(Morphisec) In a successful attack, the Orcus RAT can steal browser cookies and
passwords, launch server stress tests (DDoS attacks), disable the webcam activity light,
record microphone input, spoof file extensions, log keystrokes and more.
The Orcus RAT masquerades as a legitimate remote administration tool, although it is
clear from its features and functionality that it is not and was never intended to be. (Brian
Krebs published an interesting expose on the man behind the supposed administration
tool.) Until two weeks ago, it was publicly sold and licensed by a company calling itself
Orcus Technologies. The project is now closed, according to this “press release” issued,
and a license-free version available for download, as well as software development tools
and documentation. Interestingly, the author also claims there is a “kill switch” available
for download by security researchers to remotely shut down and lock out any Orcus
control server that they find are being used for malicious purposes.
Information
Malpedia AlienVault OTX https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9c969fa3-3382-4713-901d-a864b6c55549
Page 1 of 2

Last change to this tool card: 15 February 2023
Download this tool card in JSON format
All groups using tool Orcus RAT
Changed Name Country Observed
APT groups
  Pusikurac [Unknown] 2019  
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9c969fa3-3382-4713-901d-a864b6c55549
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9c969fa3-3382-4713-901d-a864b6c55549
Page 2 of 2