Loading malware…
Venom RAT is a commercially distributed remote access trojan for Windows associated with the Quasar RAT and AsyncRAT lineage. It supports remote command execution, keylogging, surveillance, file management, data exfiltration, and reverse-proxy functionality. A premium hidden VNC feature enables attackers to interact with compromised systems through desktops invisible to the victim.
Venom RAT establishes persistence through Windows Registry modifications and incorporates mechanisms to resist termination and interfere with security software. Observed behavior includes modifying its process discretionary access control list, terminating security-related processes, and tampering with Microsoft Defender Antivirus and scheduled-task settings. When running with elevated privileges, it can enable debug privileges and mark itself as a critical system process. It can also prevent the system from sleeping and propagate through removable USB drives.
Delivery campaigns use phishing emails with invoice, hotel-reservation, and job-application themes. Infection chains have employed JavaScript scripts, PowerShell downloaders, and intermediate loaders. Kiss Loader has delivered Venom RAT through a phishing-initiated chain and executed the decrypted payload using asynchronous procedure call injection. TA558 activity tracked within the RevengeHotels cluster has deployed Venom RAT against hotels in Brazil and Spanish-speaking markets to support theft of guest and travel-agency payment data. Other documented users include OPERA1ER, which targets financial institutions, and UAC-0050 in campaigns affecting Ukraine.
Venom RAT infrastructure was targeted during the November 2025 phase of Operation Endgame, and authorities arrested its main suspect in Greece.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Silver Fox ... [is] known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Venom RAT via DLL sideloading techniques.
Silver Fox ... [is] known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Venom RAT via DLL sideloading techniques.
“In 2021 OPERA1ER changed arsenal RATs to: Neutrino, BlackNET, bitrat and 888_rat, Venom RAT.”
...застосовано... шкідливих програм: REMCOS RAT, QUASAR RAT, VENOM RAT, REMOTE UTILITIES та LUMMASTEALER.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
"...для проникнення до мережі зловмисники використовували скомпрометовані облікові записи VPN..."
Le logiciel malveillant est principalement distribué par le biais de courriels de spear-phishing contenant des pièces jointes ou des liens malveillants, souvent en usurpant l'identité d'entités légitimes.
Le logiciel malveillant est principalement distribué par le biais de courriels de spear-phishing contenant des pièces jointes ou des liens malveillants, souvent en usurpant l'identité d'entités légitimes.
"...для проникнення до мережі зловмисники використовували скомпрометовані облікові записи VPN..."
Another notable defense evasion tactic adopted by DeepLoad is the use of asynchronous procedure call (APC) injection to run the main payload inside a trusted Windows process without a decoded payload written to disk
"...для проникнення до мережі зловмисники використовували скомпрометовані облікові записи VPN..."
Across these threads, the same pattern continued: promotion of RATs, crypters, and related tooling... On DarkForums itself, the same user was found promoting a range of tools, including... APK encryption and bypass methods... This thread, posted by “markoliver,” promoted an APK encryption method...
Le logiciel malveillant est principalement distribué par le biais de courriels de spear-phishing contenant des pièces jointes ou des liens malveillants, souvent en usurpant l'identité d'entités légitimes.
Another notable defense evasion tactic adopted by DeepLoad is the use of asynchronous procedure call (APC) injection to run the main payload inside a trusted Windows process without a decoded payload written to disk
"...для проникнення до мережі зловмисники використовували скомпрометовані облікові записи VPN..."
hVNC utilizes the Microsoft Windows Desktop API to craft a hidden desktop via the Windows feature CreateDesktop. This concealed desktop remains invisible to users... hVNC capabilities go beyond mere observation, actively emulating keyboard and mouse input, allowing cybercriminals to navigate compromised systems with precision.
Quasar RAT, un cheval de Troie d'accès à distance (RAT) bien connu...
195 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.