MalwareUsed by 1 actor

RIPTIDE

RIPTIDE is a remote access trojan (RAT) associated with APT12. According to the provided content, it communicates with command-and-control infrastructure over HTTP, and at least some payloads are encrypted with RC4. The content specifically attributes use of RIPTIDE to APT12 and identifies HTTP-based C2 as a core characteristic. No additional high-confidence details on infection vector, targeted industries, platforms, or indicators of compromise are provided in the source content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT12

APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.

via mitre attackattack.mitre.org

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

Customers authenticate to the proxy ports (81, 4444, 5555, 9191) using Basic auth. When authentication fails, the error message reads: "Your username or password is incorrect or your plan expired."

Persistence

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

Customers authenticate to the proxy ports (81, 4444, 5555, 9191) using Basic auth. When authentication fails, the error message reads: "Your username or password is incorrect or your plan expired."

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

Customers authenticate to the proxy ports (81, 4444, 5555, 9191) using Basic auth. When authentication fails, the error message reads: "Your username or password is incorrect or your plan expired."

Stealth

1 technique

T1078Valid AccountsEvidence1

TacticsInitial Access Persistence Privilege Escalation Stealth

Customers authenticate to the proxy ports (81, 4444, 5555, 9191) using Basic auth. When authentication fails, the error message reads: "Your username or password is incorrect or your plan expired."

Credential Access

1 technique

T1110.003Password SprayingEvidence1

TacticCredential Access

One had appeared in password spraying activity, and pivoting from it had uncovered additional servers.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence3

TacticCommand and Control

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

T1090.003Multi-hop ProxyEvidence1

TacticCommand and Control

The architecture is a proxy chain: customer traffic arrives at Riptide, which forwards it through upstream SOCKS5 or HTTP proxies -- likely residential or compromised endpoints. The upstreamselector package handles rotation and load balancing across the upstream pool.

T1573.001Symmetric CryptographyEvidence2

TacticCommand and Control

"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

8 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Jan 25, 2026

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®

RAT that uses HTTP for C2 communications.

mitre attackNews

Jan 25, 2026

Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001 - Enterprise | MITRE ATT&CK®

Remote access trojan that communicates over HTTP with RC4-encrypted payloads.

mitre attackNews

Mar 18, 2026

Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001 - Enterprise | MITRE ATT&CK®

RAT that communicates over HTTP and encrypts payloads using RC4.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.