Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 18:25:44 UTC
Home > List all groups > List all tools > List all groups using tool RomeoDelta
 Tool: RomeoDelta
Names
RomeoDelta
DeltaNC
Category Malware
Type Backdoor, Tunneling
Description
(Novetta) RomeoDelta is a RAT dropped by IndiaFoxtrot alongside DeltaBravo. In addition to
being dropped alongside DeltaBravo, RomeoDelta contains a significant amount of code and
artifact overlap with DeltaCharlie, indicating a shared development environment, if not a
shared developer(s).
Information
<https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf>
Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool RomeoDelta
Changed Name Country Observed
APT groups
  Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a8ac6a92-8400-405c-9fd4-1429ad193c23
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a8ac6a92-8400-405c-9fd4-1429ad193c23
Page 1 of 1