WebMonitor RAT
Aliases: RevCode
- First seen
- 2018-01-15 00:00:00
- Malware type
- rat
- Family
- Malware family
- Last IoC activity
- 2026-07-04 01:25:04
- Profile updated
- 2026-07-07 14:49:21
Targeted industries: technology-and-telecommunications financial-services government-and-public-sector
Context
On its website, Webmonitor RAT is described as 'a very powerful, user-friendly, easy-to-setup and state-of-the-art monitoring tool. Webmonitor is a fully native RAT, meaning it will run on all Windows versions and languages starting from Windows XP and up, and perfectly compatible with all crypters and protectors.' Unit42 notes in their analysis that it is offered as C2-as-a-service and raises the controversial aspect that the builder allows to create client binaries that will not show any popup or dialogue during installation or while running on a target system.
Reports & references
- krabsonsecurity.com — Bitrat Pt 2 Hidden Browser Socks5 Proxy And Unknownproducts Unmasked (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Webmonitor (report)
- revcode.se — Webmonitor (report)
- krebsonsecurity.com — Whos Behind The Revcode Webmonitor Rat (report)
- Trend Micro — Malicious Actors Target Comm Apps Such As Zoom Slack Discord (report)
- researchcenter.paloaltonetworks.com — Unit42 Say Cheese Webmonitor Rat Comes C2 Service C2Aas (report)