Loading malware…
NetWire is a commodity, cross-platform remote-access trojan first observed in 2012 and used by both financially motivated and nation-state threat actors. It enables remote access and information theft on compromised systems, with documented activity involving Windows and macOS. Its capabilities include keylogging, screen capture, process discovery, collection of host IP addresses, and theft of saved credentials from browsers including Internet Explorer, Opera, Yandex, and Chrome.
On Windows, NetWire supports persistence through scheduled tasks and Registry-based mechanisms, including Run entries and Active Setup. It can store configuration information in the Registry, while analyzed executable variants contain RC4-encrypted configuration data. Configuration parameters include command-and-control destinations, installation and persistence settings, host identifiers, and keylogger settings. NetWire derives an AES key from a configured static password to encrypt command-and-control communications and uses a mutex to prevent multiple instances from running simultaneously. It has also masqueraded as legitimate software, including TeamViewer and macOS Finder.
NetWire has been distributed through malicious email campaigns using macro-enabled Microsoft Word documents and Microsoft OneNote lures containing embedded executable or script objects. Campaigns tracked as REF2731 used U.S. tax-themed documents to deploy the PARALLAX loader, which extracted concealed NetWire payloads and injected them into legitimate Windows processes. These delivery chains employed DLL side-loading, steganography, and process injection; these loader behaviors are distinct from NetWire's own functionality. NetWire binaries have also been executed through PowerShell.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These campaigns, detailed in our previous report, distributed payloads that included AgentTesla, Formbook, Lokibot, Netwire and Betabot.
According to the researcher’s observations, AsyncRAT, NetWire, WSH RAT, and Parallax appears to be the group’s top favorites being pushed most often in malicious messages.
To give an overview, here is a list of all observed tools and malware types the actor has been using in recent years: NetWire RAT
Between January and October 2019, each of the targets were sent spearphishing emails containing malicious links that, if opened, would have installed NetWire, a commercially available spyware.
Of particular note is how these actors use a Remote Administration Tool (RAT) named NetWire (part of the NetWiredRC malware family). This RAT gives a remote attacker complete control over a Windows, Mac OS X, or Linux system through a simple graphical user interface.
VMware Carbon Black Threat Analysis Unit (TAU) analyzed HYDSEVEN NetWire samples then implemented a scanner to discover active C2 servers on the Internet by emulating the customized C2 protocol.
45 distinct techniques documented for this family, organized by ATT&CK tactic.
262 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
155 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as historical comparison for misuse of the macOS defaults utility.
A remote access trojan associated here with process injection, keylogging-related calls, and command-and-control traffic.
NetWire RAT is identified as another malware family associated with the same shared IP infrastructure, with OTX linking it to ports 5202 and 8081 during Nov 2025-Feb 2026.
Mentioned as one of several RATs distributed via OneNote files, but not the specific malware unpacked in this case study.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.