Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 00:35:09 UTC
Home > List all groups > List all tools > List all groups using tool Bozok
 Tool: Bozok
Names
Bozok
Bozok RAT
Category Tools
Type Backdoor
Description
(FireEye) Bozok, like many other popular RATs, is freely available. The author of the Bozok
RAT goes by the moniker “Slayer616” and has created another RAT known as Schwarze
Sonne, or “SS-RAT” for short. Both of these RATs are free and easy to find — various APT
actors have used both in previous targeted attacks.
Information
<https://www.fireeye.com/blog/threat-research/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html>
<https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/win.bozok>
Last change to this tool card: 13 May 2020
Download this tool card in JSON format
All groups using tool Bozok
Changed Name Country Observed
APT groups
  Patchwork, Dropping Elephant 2013-Jun 2025  
  Temper Panda, admin@338 2014  
  Transparent Tribe, APT 36 2013-Mar 2025  
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3b84982d-1de9-4e8b-8ac3-316cb15e5ed8
Page 1 of 2

3 groups listed (3 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3b84982d-1de9-4e8b-8ac3-316cb15e5ed8
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3b84982d-1de9-4e8b-8ac3-316cb15e5ed8
Page 2 of 2