MalwareUsed by 1 actor

RattyRAT

RattyRAT is a Java-based remote access trojan associated with the financially motivated Scattered Spider (UNC3944) cybercrime group. It has been used to establish persistent, stealthy access to compromised environments and to conduct internal reconnaissance. Scattered Spider has deployed RattyRAT in intrusions against large enterprises, including alongside data-extortion activity and ransomware operations. RattyRAT has also been observed in tax-themed malware-delivery campaigns.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Scattered Spider

CISA has confirmed the group is using DragonForce ransomware to encrypt victims’ ESXi environments, alongside past use of ALPHV/BlackCat and RansomHub, and custom tools like the RattyRAT remote access trojan to maintain stealthy, persistent footholds.

via malware newsmalware.news

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence2

eSentire has observed a substantial increase in malware being delivered through tax-themed phishing emails. Cybercriminals are exploiting the urgency and importance of tax-related communications to trick individuals into opening malicious email links, leading to malware infections.

T1566.002Spearphishing LinkEvidence1

These emails often appear to be sent from legitimate tax authorities or financial institutions and include malicious links leading to malware payloads hosted on attacker-controlled infrastructure.

Execution

1 technique

T1204User ExecutionEvidence1

The ZIP archive contains an LNK file, which if interacted with, leads to the deployment of GuLoader.

Credential Access

1 technique

T1056.001KeyloggingEvidence1

These malware families provide threat actors with a variety of functionalities including keylogging

Discovery

1 technique

T1018Remote System DiscoveryEvidence1

Once persistence is established on a target network, Scattered Spider threat actors often perform discovery, specifically searching for... VMware vCenter infrastructure [T1018].

Collection

5 techniques

T1056.001KeyloggingEvidence1

These malware families provide threat actors with a variety of functionalities including keylogging

T1113Screen CaptureEvidence1

including keylogging, taking screenshots

T1123Audio CaptureEvidence1

including keylogging, taking screenshots, audio and webcam recording

T1125Video CaptureEvidence1

including keylogging, taking screenshots, audio and webcam recording

T1560Archive Collected DataEvidence1

users received tax-themed malicious emails which contain a link to a password protected ZIP archive that impersonates a tax return

Command and Control

1 technique

T1219Remote Access ToolsEvidence2

[The group has used] custom tools like the RattyRAT remote access trojan to maintain stealthy, persistent footholds.

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app1 month ago

domain●●●●●●●●●●●●View more in app10 months ago

domain●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

malware newsNews

Sep 8, 2026

Scattered Spider | Who They Are, How They Attack, and How to Stop Them - Malware News - Malware Analysis, News and Indicators

Remote-access trojan used by Scattered Spider to maintain stealthy and persistent access in compromised environments.

cybersecuritynewsNews

Jul 31, 2025

CISA and FBI Shared Tactics, Techniques, and Procedures of Scattered Spider Hacker Group

Java-based remote access trojan used for persistent, stealthy remote access and internal reconnaissance.

scworldNews

Jul 30, 2025

Scattered Spider’s latest TTPs added to updated CISA joint advisory | SC Media

Remote access trojan used to establish persistence, maintain stealth, and conduct reconnaissance on compromised hosts.

Jul 29, 2025

FBI: Watch out for these signs Scattered Spider is spinning its web around your org

A Java-based remote access trojan used for long-term stealthy access and internal reconnaissance.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RattyRAT