CannonRat
CannonRat is a remote access trojan (RAT) described as a malicious tool for remote control of compromised systems that can receive commands and transmit information. Reporting places it in the toolset of the Iranian state-linked MuddyWater threat group, also tracked as Mango Sandstorm and TA450, which is attributed in the provided content to Iran's Ministry of Intelligence and Security (MOIS). In the cited context, CannonRat appears alongside other MuddyWater malware and tooling including Blackout RAT, AnchorRat, Sad C2, TreasureBox loader, BlackPearl RAT, Pheonix binary, and the Neshta virus. The broader MuddyWater campaigns described in the content targeted Israeli sectors including academia, engineering, local government, manufacturing, technology, transportation, utilities, civil aviation, tourism, healthcare, telecommunications, IT, and SMEs, as well as a technology company in Egypt. The campaigns used spear-phishing and exploitation of VPN vulnerabilities for initial access. No specific CannonRat infection chain, platform details, or indicators of compromise are provided in the content beyond its characterization as a RAT used for command reception, information transmission, and remote control of infected systems.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"CannonRat, a malicious tool designed for remote control of compromised systems"
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A RAT capable of receiving commands and transmitting information, used by MuddyWater.
Remote access tool used for remote control of compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.