Venom RAT
Venom RAT is a remote access trojan and multi-function malware tool, described as a successor to Quasar RAT and in one report as an AsyncRAT variant. It is commercially sold and has been observed in cybercrime ecosystems and malware-as-a-service style offerings, including premium hidden VNC (hVNC) functionality with customer support. Reported capabilities include keylogging, surveillance, file management, remote command execution, covert remote desktop access via hVNC, data theft, reverse proxying, anti-kill protections, persistence via Windows Registry changes, removable-media/USB propagation, and remote execution through APC injection. Additional reported behaviors include modifying process DACLs, terminating security-related processes, tampering with Task Scheduler and the Registry to disable security tools, terminating Microsoft Defender Antivirus, preventing system sleep, keeping the display on, and, when elevated, enabling SeDebugPrivilege and marking itself as a critical process.
Observed delivery vectors include phishing emails with invoice themes, JavaScript loaders, PowerShell downloaders, Windows Internet Shortcut files delivered via phishing, WebDAV-hosted shortcut chains, and loader malware such as Kiss Loader. In one documented chain, Kiss Loader decrypted and executed Venom RAT via APC injection. TA558/RevengeHotels used phishing emails in Portuguese and Spanish targeting hotels in Brazil and Spanish-speaking markets to deliver Venom RAT, with the objective of stealing credit card data from hotel systems and online travel agencies. CERT-UA also reported Venom RAT among malware families used by UAC-0050 in campaigns affecting Ukrainian organizations. Venom RAT infrastructure was also included in Europol/Eurojust Operation Endgame in November 2025, which dismantled more than 1,025 servers and seized domains linked to Venom RAT, Rhadamanthys, and the Elysium botnet; one report states the main Venom RAT suspect was arrested in Greece.
Targeting and victimology directly mentioned in the content include hospitality, hotel, and travel organizations in Latin America, especially Brazil and Spanish-speaking regions, as well as Ukrainian government, energy, finance, healthcare, and IT organizations in broader campaign reporting. Infrastructure associated with Venom RAT was identified in the 45.154.98.0/24 subnet alongside other malware families. High-confidence indicators and artifacts mentioned in relation to Venom RAT activity include use of hVNC; JavaScript and PowerShell-based loaders; APC injection; and campaign artifacts such as the downloaded file name "cargajecerrr.txt" in TA558 activity.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...застосовано... шкідливих програм: REMCOS RAT, QUASAR RAT, VENOM RAT, REMOTE UTILITIES та LUMMASTEALER.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniquePersistence
1 techniquePrivilege Escalation
2 techniquesAnother notable defense evasion tactic adopted by DeepLoad is the use of asynchronous procedure call (APC) injection to run the main payload inside a trusted Windows process without a decoded payload written to disk
Stealth
3 techniquesAcross these threads, the same pattern continued: promotion of RATs, crypters, and related tooling... On DarkForums itself, the same user was found promoting a range of tools, including... APK encryption and bypass methods... This thread, posted by “markoliver,” promoted an APK encryption method...
Another notable defense evasion tactic adopted by DeepLoad is the use of asynchronous procedure call (APC) injection to run the main payload inside a trusted Windows process without a decoded payload written to disk
Lateral Movement
1 techniquehVNC utilizes the Microsoft Windows Desktop API to craft a hidden desktop via the Windows feature CreateDesktop. This concealed desktop remains invisible to users... hVNC capabilities go beyond mere observation, actively emulating keyboard and mouse input, allowing cybercriminals to navigate compromised systems with precision.
Command and Control
1 techniqueThe post promoted “EagleSpy v5” as a lifetime-activated Android RAT... additional threads associated with the same user across DarkForums, including posts promoting other tools such as Craxs RAT, XWorm HVNC RAT... On DarkForums itself, the same user was found promoting a range of tools, including: Craxs RAT, XWorm HVNC RAT...
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan promoted in a Pro HVNC RAT variant.
A remote access trojan observed on the same /24 subnet among other criminal tooling.
Remote access trojan delivered as the final payload by Kiss Loader; described as an AsyncRAT variant and executed via APC injection.
Remote access trojan disrupted as part of Operation Endgame.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.