{
	"id": "650c9286-75c5-4e83-b24e-0c5908bdc699",
	"created_at": "2026-04-06T00:10:15.222574Z",
	"updated_at": "2026-04-10T03:36:21.908376Z",
	"deleted_at": null,
	"sha1_hash": "51c349b7f530d975a58177c9fa15e83e446eb2d0",
	"title": "Revenge RAT (Malware Family)",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 75390,
	"plain_text": "Revenge RAT (Malware Family)\r\nBy Fraunhofer FKIE\r\nArchived: 2026-04-05 21:08:26 UTC\r\nAccording to Cofense, Revenge RAT is a simple and freely available Remote Access Trojan that automatically\r\ngathers system information before allowing threat actors to remotely access system components such as webcams,\r\nmicrophones, and various other utilities.\r\n2024-12-18 ⋅ Kaspersky Labs ⋅ Kaspersky\r\nAnalysis of Cyber Anarchy Squad attacks targeting Russian and Belarusian organizations\r\nBabuk LockBit Revenge RAT SparkRAT Cyber Alliance Ukrainian Cyber Alliance 2023-10-05 ⋅ Twitter\r\n(@embee_research) ⋅ Embee_research\r\nIntroduction to DotNet Configuration Extraction - RevengeRAT\r\nRevenge RAT 2022-08-18 ⋅ Proofpoint ⋅ Joe Wise, Proofpoint Threat Research Team, Selena Larson\r\nReservations Requested: TA558 Targets Hospitality and Travel\r\nAsyncRAT Loda NjRAT Ozone RAT Revenge RAT Vjw0rm 2022-04-07 ⋅ Perception Point ⋅ Igal Lytzki\r\nRevenge RAT Malware is back: From Microsoft Excel macros to Remote Access Trojan\r\nRevenge RAT 2022-02-08 ⋅ Itay Migdal\r\nRevengeRAT Analysis\r\nRevenge RAT 2021-05-20 ⋅ Github (microsoft) ⋅ Microsoft\r\nMicrosoft 365 Defender Hunting Queries for hunting multiple threat actors' TTPs and malwares\r\nSTRRAT OceanLotus BabyShark Elise Revenge RAT WastedLocker Zebrocy 2021-05-14 ⋅ Morphisec ⋅ Arnold Osipov\r\nAHK RAT Loader Used in Unique Delivery Campaigns\r\nAsyncRAT Houdini Revenge RAT 2021-05-07 ⋅ Morphisec ⋅ Nadav Lorber\r\nRevealing the ‘Snip3’ Crypter, a Highly Evasive RAT Loader\r\nAgent Tesla AsyncRAT NetWire RC Revenge RAT 2021-04-21 ⋅ Talos ⋅ Vanja Svajcer\r\nA year of Fajan evolution and Bloomberg themed campaigns\r\nMASS Logger Nanocore RAT NetWire RC Revenge RAT XpertRAT 2021-03-12 ⋅ Reversing Labs ⋅ Robert Simmons\r\nDotNET Loaders\r\nRevenge RAT 2020-12-29 ⋅ Uptycs ⋅ Abhijit Mohanta\r\nRevenge RAT targeting users in South America\r\nRevenge RAT 2020-10-26 ⋅ ⋅ 360 Core Security ⋅ 360\r\n北非狐（APT-C-44）攻击活动揭露\r\nXtreme RAT Houdini NjRAT Revenge RAT 2020-01-31 ⋅ ReversingLabs ⋅ Robert Simmons\r\nRATs in the Library: Remote Access Trojans Hide in Plain \"Public\" Site\r\nCyberGate LimeRAT NjRAT Quasar RAT Revenge RAT 2020-01-19 ⋅ 360 ⋅ kate\r\nBayWorld event, Cyber Attack Against Foreign Trade Industry\r\nAzorult Formbook Nanocore RAT Revenge RAT 2019-11-28 ⋅ Kaspersky Labs ⋅ GReAT\r\nRevengeHotels: cybercrime targeting hotel front desks worldwide\r\nRevenge RAT ProCC RevengeHotels 2019-11-11 ⋅ Binary Defense ⋅ Binary Defense\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat\r\nPage 1 of 2\n\nRevenge Is A Dish Best Served… Obfuscated?\r\nHoudini Revenge RAT 2019-09-19 ⋅ NSHC ⋅ ThreatRecon Team\r\nHagga of SectorH01 continues abusing Bitly, Blogger and Pastebin to deliver RevengeRAT and NanoCore\r\nNanocore RAT Revenge RAT 2019-06-08 ⋅ Yoroi ⋅ Davide Testa, Luca Mella, Luigi Martire, ZLAB-Yoroi\r\nThe Evolution of Aggah: From Roma225 to the RG Campaign\r\nRevenge RAT 2018-08-02 ⋅ Palo Alto Networks Unit 42 ⋅ David Fuertes, Josh Grunzweig, Kyle Wilhoit, Robert Falcone\r\nThe Gorgon Group: Slithering Between Nation State and Cybercrime\r\nLoki Password Stealer (PWS) Nanocore RAT NjRAT Quasar RAT Remcos Revenge RAT 2017-07-08 ⋅ InfoSec\r\nHandlers Diary Blog ⋅ Xavier Mertens\r\nA VBScript with Obfuscated Base64 Data\r\nRevenge RAT\r\nThere is no Yara-Signature yet.\r\nSource: https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat\r\nhttps://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat"
	],
	"report_names": [
		"win.revenge_rat"
	],
	"threat_actors": [
		{
			"id": "414d7c65-5872-4e56-8a7d-49a2aeef1632",
			"created_at": "2025-08-07T02:03:24.7983Z",
			"updated_at": "2026-04-10T02:00:03.76109Z",
			"deleted_at": null,
			"main_name": "COPPER FIELDSTONE",
			"aliases": [
				"APT36 ",
				"Earth Karkaddan ",
				"Gorgon Group ",
				"Green Havildar ",
				"Mythic Leopard ",
				"Operation C-Major ",
				"Operation Transparent Tribe ",
				"Pasty Draco ",
				"ProjectM ",
				"Storm-0156 "
			],
			"source_name": "Secureworks:COPPER FIELDSTONE",
			"tools": [
				"CapraRAT",
				"Crimson RAT",
				"DarkComet",
				"ElizaRAT",
				"LuminosityLink",
				"ObliqueRAT",
				"Peppy",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "af509bbb-8d18-4903-a9bd-9e94099c6b30",
			"created_at": "2023-01-06T13:46:38.585525Z",
			"updated_at": "2026-04-10T02:00:03.030833Z",
			"deleted_at": null,
			"main_name": "APT32",
			"aliases": [
				"OceanLotus",
				"ATK17",
				"G0050",
				"APT-C-00",
				"APT-32",
				"Canvas Cyclone",
				"SeaLotus",
				"Ocean Buffalo",
				"OceanLotus Group",
				"Cobalt Kitty",
				"Sea Lotus",
				"APT 32",
				"POND LOACH",
				"TIN WOODLAWN",
				"Ocean Lotus"
			],
			"source_name": "MISPGALAXY:APT32",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "bfae615f-cb9c-479c-b97d-ba282c322db3",
			"created_at": "2022-10-25T16:07:24.123308Z",
			"updated_at": "2026-04-10T02:00:04.874176Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "ETDA:RevengeHotels",
			"tools": [
				"888 RAT",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "316b23b5-e097-4dc6-8b1c-d096860c6c16",
			"created_at": "2022-10-25T16:07:24.290801Z",
			"updated_at": "2026-04-10T02:00:04.924688Z",
			"deleted_at": null,
			"main_name": "TA558",
			"aliases": [],
			"source_name": "ETDA:TA558",
			"tools": [
				"AZORult",
				"AsyncRAT",
				"Bladabindi",
				"ExtRat",
				"Jorik",
				"Loda",
				"Loda RAT",
				"LodaRAT",
				"Nymeria",
				"PuffStealer",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Rultazo",
				"Socmer",
				"Vengeance Justice Worm",
				"Vjw0rm",
				"Xtreme RAT",
				"XtremeRAT",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "870f6f62-84f5-48ca-a18e-cf2902cd6924",
			"created_at": "2022-10-25T15:50:23.303818Z",
			"updated_at": "2026-04-10T02:00:05.301184Z",
			"deleted_at": null,
			"main_name": "APT32",
			"aliases": [
				"APT32",
				"SeaLotus",
				"OceanLotus",
				"APT-C-00",
				"Canvas Cyclone"
			],
			"source_name": "MITRE:APT32",
			"tools": [
				"Mimikatz",
				"ipconfig",
				"Kerrdown",
				"Cobalt Strike",
				"SOUNDBITE",
				"OSX_OCEANLOTUS.D",
				"KOMPROGO",
				"netsh",
				"RotaJakiro",
				"PHOREAL",
				"Arp",
				"Denis",
				"Goopy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "31a4f4ad-1aa7-48c2-8b16-58d48879644c",
			"created_at": "2024-02-06T02:00:04.13577Z",
			"updated_at": "2026-04-10T02:00:03.576453Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "MISPGALAXY:RevengeHotels",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b3bf17ff-3cbf-457c-8770-b038ed609993",
			"created_at": "2024-02-22T02:00:03.766129Z",
			"updated_at": "2026-04-10T02:00:03.589884Z",
			"deleted_at": null,
			"main_name": "ProCC",
			"aliases": [],
			"source_name": "MISPGALAXY:ProCC",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b0d34dd6-ee90-483b-bb6c-441332274160",
			"created_at": "2022-10-25T16:07:23.296754Z",
			"updated_at": "2026-04-10T02:00:04.526403Z",
			"deleted_at": null,
			"main_name": "Aggah",
			"aliases": [
				"Operation Red Deer",
				"Operation Roma225"
			],
			"source_name": "ETDA:Aggah",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"Aggah",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Negasteal",
				"Origin Logger",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Warzone",
				"Warzone RAT",
				"ZPAQ",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "18278778-fa63-4a9a-8988-4d266b8c5c1a",
			"created_at": "2023-01-06T13:46:38.769816Z",
			"updated_at": "2026-04-10T02:00:03.094179Z",
			"deleted_at": null,
			"main_name": "The Gorgon Group",
			"aliases": [
				"Gorgon Group",
				"Subaat",
				"ATK92",
				"G0078",
				"Pasty Gemini"
			],
			"source_name": "MISPGALAXY:The Gorgon Group",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "97fdaf9f-cae1-4ccc-abe2-76e5cbc0febd",
			"created_at": "2022-10-25T15:50:23.296989Z",
			"updated_at": "2026-04-10T02:00:05.347085Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"Gorgon Group"
			],
			"source_name": "MITRE:Gorgon Group",
			"tools": [
				"NanoCore",
				"QuasarRAT",
				"Remcos",
				"njRAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "4a73cb62-be05-49d2-9dbb-1298606ec0a3",
			"created_at": "2025-03-07T02:00:03.799095Z",
			"updated_at": "2026-04-10T02:00:03.827106Z",
			"deleted_at": null,
			"main_name": "Ukrainian Cyber Alliance",
			"aliases": [
				"UCA"
			],
			"source_name": "MISPGALAXY:Ukrainian Cyber Alliance",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "98cd3bc4-fd41-4087-be03-f6f8f3be7b67",
			"created_at": "2025-05-29T02:00:03.220566Z",
			"updated_at": "2026-04-10T02:00:03.871851Z",
			"deleted_at": null,
			"main_name": "Cyber Alliance",
			"aliases": [],
			"source_name": "MISPGALAXY:Cyber Alliance",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "28851008-77b4-47eb-abcd-1bb5b3f19fc2",
			"created_at": "2023-06-20T02:02:10.254614Z",
			"updated_at": "2026-04-10T02:00:03.365336Z",
			"deleted_at": null,
			"main_name": "Hagga",
			"aliases": [
				"TH-157",
				"Aggah"
			],
			"source_name": "MISPGALAXY:Hagga",
			"tools": [
				"Agent Tesla"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c26ba56b-628e-4610-b167-1610efb08459",
			"created_at": "2024-02-22T02:00:03.77679Z",
			"updated_at": "2026-04-10T02:00:03.594516Z",
			"deleted_at": null,
			"main_name": "Cyber.Anarchy.Squad",
			"aliases": [
				"Cyber Anarchy Squad"
			],
			"source_name": "MISPGALAXY:Cyber.Anarchy.Squad",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "cf91b389-9602-45c0-8d6b-c61d14800f54",
			"created_at": "2023-01-06T13:46:39.448277Z",
			"updated_at": "2026-04-10T02:00:03.332604Z",
			"deleted_at": null,
			"main_name": "TA558",
			"aliases": [],
			"source_name": "MISPGALAXY:TA558",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "5da6b5fd-1955-412a-81aa-069fb50b6e31",
			"created_at": "2025-08-07T02:03:25.116085Z",
			"updated_at": "2026-04-10T02:00:03.668978Z",
			"deleted_at": null,
			"main_name": "TIN WOODLAWN",
			"aliases": [
				"APT32 ",
				"Cobalt Kitty",
				"OceanLotus",
				"WOODLAWN "
			],
			"source_name": "Secureworks:TIN WOODLAWN",
			"tools": [
				"Cobalt Strike",
				"Denis",
				"Goopy",
				"JEShell",
				"KerrDown",
				"Mimikatz",
				"Ratsnif",
				"Remy",
				"Rizzo",
				"RolandRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "6c4e4b91-1f98-49e2-90e6-435cea8d3d53",
			"created_at": "2022-10-25T16:07:23.693797Z",
			"updated_at": "2026-04-10T02:00:04.711987Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"ATK 92",
				"G0078",
				"Pasty Draco",
				"Subaat",
				"TAG-CR5"
			],
			"source_name": "ETDA:Gorgon Group",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"Atros2.CKPN",
				"Bladabindi",
				"CinaRAT",
				"Crimson RAT",
				"ForeIT",
				"Jorik",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Loki",
				"Loki.Rat",
				"LokiBot",
				"LokiPWS",
				"MSIL",
				"MSIL/Crimson",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Negasteal",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Origin Logger",
				"Quasar RAT",
				"QuasarRAT",
				"Recam",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"SEEDOOR",
				"Scarimson",
				"Socmer",
				"Yggdrasil",
				"ZPAQ",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2439ad53-39cc-4fff-8fdf-4028d65803c0",
			"created_at": "2022-10-25T16:07:23.353204Z",
			"updated_at": "2026-04-10T02:00:04.55407Z",
			"deleted_at": null,
			"main_name": "APT 32",
			"aliases": [
				"APT 32",
				"APT-C-00",
				"APT-LY-100",
				"ATK 17",
				"G0050",
				"Lotus Bane",
				"Ocean Buffalo",
				"OceanLotus",
				"Operation Cobalt Kitty",
				"Operation PhantomLance",
				"Pond Loach",
				"SeaLotus",
				"SectorF01",
				"Tin Woodlawn"
			],
			"source_name": "ETDA:APT 32",
			"tools": [
				"Agentemis",
				"Android.Backdoor.736.origin",
				"AtNow",
				"Backdoor.MacOS.OCEANLOTUS.F",
				"BadCake",
				"CACTUSTORCH",
				"CamCapture Plugin",
				"CinaRAT",
				"Cobalt Strike",
				"CobaltStrike",
				"Cuegoe",
				"DKMC",
				"Denis",
				"Goopy",
				"HiddenLotus",
				"KOMPROGO",
				"KerrDown",
				"METALJACK",
				"MSFvenom",
				"Mimikatz",
				"Nishang",
				"OSX_OCEANLOTUS.D",
				"OceanLotus",
				"PHOREAL",
				"PWNDROID1",
				"PhantomLance",
				"PowerSploit",
				"Quasar RAT",
				"QuasarRAT",
				"RatSnif",
				"Remy",
				"Remy RAT",
				"Rizzo",
				"Roland",
				"Roland RAT",
				"SOUNDBITE",
				"Salgorea",
				"Splinter RAT",
				"Terracotta VPN",
				"Yggdrasil",
				"cobeacon",
				"denesRAT",
				"fingerprintjs2"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434215,
	"ts_updated_at": 1775792181,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/51c349b7f530d975a58177c9fa15e83e446eb2d0.pdf",
		"text": "https://archive.orkl.eu/51c349b7f530d975a58177c9fa15e83e446eb2d0.txt",
		"img": "https://archive.orkl.eu/51c349b7f530d975a58177c9fa15e83e446eb2d0.jpg"
	}
}