Revcode

Revcode is the handle of a cybercriminal malware seller associated with the development, marketing, and operation of WebMonitor, a commodity remote access trojan active since 2017. Revcode advertised WebMonitor on underground forums and operated a hosted sales and support service around the malware. WebMonitor was offered as a low-cost, hosted malware service rather than a standalone toolset. Its operator provided a web-based command-and-control environment and did not allow customers to run independent infrastructure, indicating a centralized malware-as-a-service model. The malware’s Windows client was implemented in Visual Basic 6, commonly packed, and configured for user-level persistence through Windows Run-key autostart mechanisms. Builder options supported startup execution and process restart behavior, reflecting a focus on durable access to compromised hosts. Operationally, WebMonitor used HTTPS for command-and-control communications and customer-specific virtual hostnames under operator-controlled root domains. Later variants introduced repeated DNS lookups for non-existent domains, assessed as either camouflage for command-and-control activity or an unrealized domain-generation-style mechanism. One observed sample also contacted a Monero mining pool, but that behavior was seen only once and is not sufficient to characterize Revcode primarily as a cryptomining actor. The actor appears to have maintained a modest customer base while enabling broad malicious activity through downstream users. WebMonitor infections were observed globally across multiple industry verticals, consistent with indiscriminate commodity malware distribution rather than narrowly targeted espionage. High-confidence reporting links the infrastructure registration to an individual in Bavaria, Germany. A related associate identified as Softpatch was connected to an Android RAT offering tied to the broader WebMonitor ecosystem.