Revenge RAT
Software · ATTACK:enterprise:S0379
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0379",
"title": "Revenge RAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0379",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--bdb27a1d-1844-42f1-a0c0-826027ae0326",
"external_id": "S0379",
"domain": "enterprise",
"created": "2019-05-02T01:07:36.780Z",
"modified": "2024-11-17T23:54:41.761Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Cofense RevengeRAT Feb 2019",
"url": "https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"
},
{
"source_name": "Cylance Shaheen Nov 2018",
"url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01c6d850-03c2-4ed0-ba1d-cf2cc9062106
Cylance Shaheen Nov 2018ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S0379
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ba28e4c-66d1-4e45-bd21-44b7ea174579
Proofpoint TA2541 February 2022ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d65c2d6-6f59-40e4-af56-83ad4d9efea8
Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f5aee41-e3bc-4ed0-a0e2-fa8f7cd6de26
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21537040-e89a-4908-95c2-2c5d905bcc2f
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dc986cb-ed76-42ba-9dd9-edaba07b0cc7
Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fa454cd-2fff-41ca-bfd0-0dce49d34f6d
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6765828a-168f-4dd7-8c1b-00f7d98daef5
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d10e49f-ebd6-47c5-9042-96bd54f7ca79
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1102.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79c960d7-edf2-4005-8c0a-31acd830ca8a
Cofense RevengeRAT Feb 2019ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:S0379
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--852e45c7-0d49-43ff-b15c-dd4f6d51703f
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9691e661-14fc-4eee-b7d0-14ef24bd6a27
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f99cba5-2fb2-4750-aca4-3d4a0a872685
Cofense RevengeRAT Feb 2019ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1547.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a01a08e6-3e5a-4674-9d8b-67395fdf9b55
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1123
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ade8894f-e9fd-4391-98c3-d43ad2d7ab9c
Cofense RevengeRAT Feb 2019 · Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1691566-c8c2-4d93-b5b0-3f5264608d1b
Cofense RevengeRAT Feb 2019ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1c4fbea-d3d4-4e9a-ab46-8683f2bde40b
Cofense RevengeRAT Feb 2019ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1202
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5612c39-e246-409b-97cb-57067cfa27b4
Cofense RevengeRAT Feb 2019ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c67ddbdb-7e07-45b3-9f7d-5cdf959ac3b2
Cylance Shaheen Nov 2018ATTACK:enterprise:S0379 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea8f4a2f-6c4e-451e-a107-407d0fc06459
Cofense RevengeRAT Feb 2019