FormerFirstRAT
Aliases: ffrat
- First seen
- 2017-05-15 00:00:00
- Malware type
- rat
- Family
- Malware family
- Profile updated
- 2026-07-07 12:48:30
Targeted industries: government-and-public-sector technology-and-telecommunications defense-and-aerospace
Targeted regions: country_code:us country_code:cn country_code:ru
Context
FormerFirstRAT is a remote access tool often associated with cyber espionage activities targeting government, technology, and defense sectors. It is known for its capabilities in data exfiltration and monitoring compromised systems.
Reports & references
- Palo Alto Unit 42 — Shallowtaurus (report)
- decoded.avast.io — Operation Dragon Castling Apt Group Targeting Betting Companies (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Former First Rat (report)
- researchcenter.paloaltonetworks.com — Unit 42 Identifies New Dragonok Backdoor Malware Deployed Against Japanese Targets (report)
- ptsecurity.com — Space Pirates Tools And Connections (report)
- threatvector.cylance.com — Breaking Down Ff Rat Malware (report)