SombRAT
MITRE ATT&CK: S0615 View on attack.mitre.org
Aliases: SombRAT
- First seen
- 2019-01-01 00:00:00
- Malware type
- backdoor, rat
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 30 (30 malicious)
- Last IoC activity
- 2026-10-17 03:32:01
- Profile updated
- 2026-07-07 13:10:11
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical technology-and-telecommunications
Context
SombRAT is a modular backdoor written in C++ that has been used since at least 2019 to download and execute malicious payloads, including FIVEHANDS ransomware.
Recent IoC activity
30 malicious indicators in Maltiverse are attributed to SombRAT (S0615). The 20 most recently updated:
Detection coverage
- 2 YARA rules
- 392 Sigma rules
Malware & tools used
- System Time Discovery (attack-pattern)
- Process Discovery (attack-pattern)
- Proxy (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- Data from Local System (attack-pattern)
- Native API (attack-pattern)
- Obfuscated Files or Information (attack-pattern)
- File Deletion (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Non-Application Layer Protocol (attack-pattern)
- Process Argument Spoofing (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Archive via Custom Method (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- DNS (attack-pattern)
- Local Data Staging (attack-pattern)
- Domain Generation Algorithms (attack-pattern)
- System Service Discovery (attack-pattern)
- Dynamic-link Library Injection (attack-pattern)
- File and Directory Discovery (attack-pattern)
- Masquerading (attack-pattern)
- System Information Discovery (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
Used by threat actors
- CostaRicto (campaign)
Detection rules
- MALPEDIA_Win_Sombrat_Auto (yara-rule)
- SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 (yara-rule)
Reports & references
- blogs.blackberry.com — The Costaricto Campaign Cyber Espionage Outsourced (report)
- rewterz.com — Rewterz Threat Alert Financially Motivated Aggressive Group Carrying Out Ransomware Campaigns Active Iocs (report)
- Mandiant — Unc2447 Sombrat And Fivehands Ransomware Sophisticated Financial Threat (report)
- CISA — Ar21 126A (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sombrat (report)
- blogs.blackberry.com — Threat Thursday Sombrat Always Leave Yourself A Backdoor (report)
- MITRE ATT&CK — S0615 (report)