RDAT

MITRE ATT&CK: S0495 View on attack.mitre.org

Aliases: GREYSTUFF, RDAT

First seen
2017-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 12:48:59

Targeted industries: technology-and-telecommunications

Targeted regions: country_code:ir

Context

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.

Detection coverage

  • 1 YARA rules
  • 244 Sigma rules

Malware & tools used

  • Steganography (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • DNS (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Screen Capture (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Non-Standard Encoding (attack-pattern)
  • Windows Service (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Mail Protocols (attack-pattern)
  • Steganography (attack-pattern)
  • Data Transfer Size Limits (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • File Deletion (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Fallback Channels (attack-pattern)
  • Data Obfuscation (attack-pattern)
  • Web Protocols (attack-pattern)

Used by threat actors

Detection rules

  • ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 (yara-rule)

Reports & references

  • Palo Alto Unit 42 — Oilrig Novel C2 Channel Steganography (report)
  • Palo Alto Unit 42 — Evasive Serpens (report)
  • CrowdStrike — Report2020Overwatchnowheretohide (report)
  • ESET — Bladedfeline Whispering Dark (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Rdat (report)
  • MITRE ATT&CK — S0495 (report)

External references