Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-06 02:57:55 UTC Home > List all groups > List all tools > List all groups using tool Vcrodat Tool: Vcrodat Names Vcrodat Category Malware Type Loader, Downloader Description (Symantec) In some attacks, Whitefly has used a second piece of custom malware, Trojan.Nibatad. Like Vcrodat, Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer. And similar to Vcrodat, the Nibatad payload is designed to facilitate information theft from an infected computer. While Vcrodat is delivered via the malicious dropper, we have yet to discover how Nibatad is delivered to the infected computer. Why Whitefly uses these two different loaders in some of its attacks remains unknown. And while we have found both Vcrodat and Nibatad inside individual victim organizations, we have not found any evidence of them being used simultaneously on a single computer. Information Last change to this tool card: 20 April 2020 Download this tool card in JSON format All groups using tool Vcrodat Changed Name Country Observed APT groups   Whitefly, Mofang [Unknown] 2012-Jul 2018   1 group listed (1 APT, 0 other, 0 unknown) https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dca2e632-9d9b-4df6-8e38-e5a47e4d0d09 Page 1 of 2 Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dca2e632-9d9b-4df6-8e38-e5a47e4d0d09 https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dca2e632-9d9b-4df6-8e38-e5a47e4d0d09 Page 2 of 2 APT groups Whitefly, Mofang [Unknown] 2012-Jul 2018 1 group listed (1 APT, 0 other, 0 unknown) Page 1 of 2