WarzoneRAT
MITRE ATT&CK: S0670 View on attack.mitre.org
Aliases: Warzone, Ave Maria, AVE_MARIA, AveMariaRAT, Warzone RAT, WarzoneRAT, avemaria
- First seen
- 2018-10-01 00:00:00
- Malware type
- rat, credential-stealer
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 2162 (1771 malicious)
- Last IoC activity
- 2026-10-17 04:09:50
- Profile updated
- 2026-07-07 12:38:40
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical retail-and-hospitality technology-and-telecommunications
Context
WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.
Recent IoC activity
1,772 malicious indicators in Maltiverse are attributed to WarzoneRAT (S0670). The 20 most recently updated:
Detection coverage
- 2 YARA rules
- 844 Sigma rules
Malware & tools used
- Process Discovery (attack-pattern)
- Keylogging (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Malicious File (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Bypass User Account Control (attack-pattern)
- Data from Local System (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- System Information Discovery (attack-pattern)
- Proxy (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Remote Desktop Protocol (attack-pattern)
- Modify Registry (attack-pattern)
- Component Object Model Hijacking (attack-pattern)
- Hide Artifacts (attack-pattern)
- Spearphishing Attachment (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- PowerShell (attack-pattern)
- Native API (attack-pattern)
- Video Capture (attack-pattern)
- Hidden Window (attack-pattern)
- Process Injection (attack-pattern)
- Windows Command Shell (attack-pattern)
Used by threat actors
- Scattered Spider (threat-actor)
- TA2541 (threat-actor)
- Confucius (threat-actor)
Detection rules
- MALPEDIA_Win_Ave_Maria_Auto (yara-rule)
- DITEKSHEN_MALWARE_Win_Warzonerat (yara-rule)
Reports & references
- Cisco Talos — Attributing Yorotrooper (report)
- uptycs.com — Confucius Apt Deploys Warzone Rat (report)
- CISA — Aa23 320A (report)
- blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
- spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
- Kaspersky — 99204 (report)
- ciphertechsolutions.com — Roboski Global Recovery Automation (report)
- securityintelligence.com — Roboski Global Recovery Automation (report)
- Kaspersky — 90703 (report)
- pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
- kaspersky.com — 2019 Fin7 Hacking Group Targets More Than 130 Companies After Leaders Arrest (report)
- Kaspersky — 109552 (report)
- CISA — Aa23 320A Scattered Spider (report)
- info.spamhaus.com — 2023%20Q2%20Botnet%20Threat%20Update (report)
- Cisco Talos — 2020 Year In Malware (report)
- info.spamhaus.com — 2022%20Q3%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q3%20Botnet%20Threat%20Update (report)
- info.spamhaus.com — 2023%20Q1%20Botnet%20Threat%20Update (report)
- cocomelonc.github.io — Malware Pers 3 (report)
- blog.cyber5w.com — Analyzing Macro Enabled Office Documents (report)
- Trend Micro — Apt C 36 Updates Its Long Term Spam Campaign Against South Ameri (report)
- MITRE ATT&CK — S0670 (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ave Maria (report)
- muha2xmad.github.io — Warzonerat (report)
- youtube.com — Watch (report)