Revenge RAT
MITRE ATT&CK: S0379 View on attack.mitre.org
Aliases: Revetrat, Revenge RAT
- First seen
- 2016-10-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 495 (445 malicious)
- Last IoC activity
- 2026-10-17 03:25:10
- Profile updated
- 2026-07-07 13:12:42
Targeted industries: government-and-public-sector financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
Revenge RAT is a freely available remote access tool written in .NET (C#).
Recent IoC activity
445 malicious indicators in Maltiverse are attributed to Revenge RAT (S0379). The 20 most recently updated:
Detection coverage
- 499 Sigma rules
Malware & tools used
- Keylogging (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- OS Credential Dumping (attack-pattern)
- Video Capture (attack-pattern)
- Remote Desktop Protocol (attack-pattern)
- System Information Discovery (attack-pattern)
- Standard Encoding (attack-pattern)
- Bidirectional Communication (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Mshta (attack-pattern)
- Winlogon Helper DLL (attack-pattern)
- Audio Capture (attack-pattern)
- Windows Command Shell (attack-pattern)
- PowerShell (attack-pattern)
- Indirect Command Execution (attack-pattern)
- Screen Capture (attack-pattern)
- Scheduled Task (attack-pattern)
- System Owner/User Discovery (attack-pattern)
Used by threat actors
- The White Company (threat-actor)
- TA2541 (threat-actor)
Reports & references
- cylance.com — Whitecompanyoperationshaheenreport (report)
- researchcenter.paloaltonetworks.com — Unit42 Gorgon Group Slithering Nation State Cybercrime (report)
- Kaspersky — 95229 (report)
- Kaspersky — 114990 (report)
- blogs.360.cn — Apt C 44 (report)
- mp.weixin.qq.com — Gwoirnplvqx761Lw8X S5G (report)
- binarydefense.com — Revenge Is A Dish Best Served Obfuscated (report)
- Cisco Talos — A Year Of Fajan Evolution And Bloomberg (report)
- threatrecon.nshc.net — Sectorh01 Continues Abusing Web Services (report)
- Cisco Talos — Rat Ratatouille Revrat Orcus (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Revenge Rat (report)
- perception-point.io — Revenge Rat Back From Microsoft Excel Macros (report)
- yoroi.company — The Evolution Of Aggah From Roma225 To The Rg Campaign (report)
- isc.sans.edu — 22590 (report)
- uptycs.com — Revenge Rat Targeting Users In South America (report)
- blog.reversinglabs.com — Dotnet Loaders (report)
- github.com — Revengerat.Md (report)
- embee-research.ghost.io — Introduction To Dotnet Configuration Extraction Revengerat (report)
- MITRE ATT&CK — S0379 (report)
- web.archive.org — Upgrades Delivery Support Infrastructure Revenge Rat Malware Bigger Threat (report)
- github.com — Microsoft 365 Defender Hunting Queries (report)
- blog.morphisec.com — Revealing The Snip3 Crypter A Highly Evasive Rat Loader (report)
- blog.360totalsecurity.com — Bayworld Event Cyber Attack Against Foreign Trade Industry (report)
- blog.yoroi.company — Aggah How To Run A Botnet Without Renting A Server For More Than A Year (report)
- proofpoint.com — Reservations Requested Ta558 Targets Hospitality And Travel (report)