VERMIN
MITRE ATT&CK: S0257 View on attack.mitre.org
Aliases: VERMIN
- First seen
- 2018-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 13:13:49
Targeted industries: government-and-public-sector
Targeted regions: country_code:ua
Context
VERMIN is a remote access tool written in the Microsoft .NET framework. It is mostly composed of original code, but also has some open source code.
Detection coverage
- 242 Sigma rules
Malware & tools used
- System Network Configuration Discovery (attack-pattern)
- Software Packing (attack-pattern)
- Web Protocols (attack-pattern)
- Audio Capture (attack-pattern)
- File Deletion (attack-pattern)
- Keylogging (attack-pattern)
- Security Software Discovery (attack-pattern)
- Clipboard Data (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Automated Collection (attack-pattern)
- Archive Collected Data (attack-pattern)
- Screen Capture (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- System Information Discovery (attack-pattern)
- Process Discovery (attack-pattern)
Reports & references
- socprime.com — Vermin Uac 0020 Hacking Collective Hits Ukrainian Government And Military With Spectr Malware (report)
- ESET — Deep Dive Vermin Rathole (report)
- Mandiant — Spear Phishing Campaign Targets Ukraine Government (report)
- researchcenter.paloaltonetworks.com — Unit42 Vermin Quasar Rat Custom Malware Used Ukraine (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Vermin (report)
- MITRE ATT&CK — S0257 (report)