NekroWire RAT
NekroWire RAT is a custom remote access trojan previously used by the threat activity cluster SloppyLemming, also tracked as Outrider Tiger and Fishing Elephant. Arctic Wolf reported that SloppyLemming had previously used Cobalt Strike, Havoc, Ares RAT, WarHawk, and the custom NekroWire RAT in campaigns targeting government and critical infrastructure entities in South Asia. The reporting ties SloppyLemming activity to espionage-focused targeting of organizations in Pakistan and Bangladesh, with broader historical targeting including government, law enforcement, energy, telecommunications, and technology sectors in Pakistan, Sri Lanka, Bangladesh, and China. The provided content does not describe NekroWire RAT’s internal functionality, infection chain, persistence, command-and-control protocol, or specific indicators of compromise beyond its identification as a custom RAT associated with SloppyLemming.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...borrowed adversary simulation frameworks such as Cobalt Strike, Havoc, and the custom NekroWire RAT"
"...borrowed adversary simulation frameworks such as Cobalt Strike, Havoc, and the custom NekroWire RAT."
"...borrowed adversary simulation frameworks such as Cobalt Strike, Havoc, and the custom NekroWire RAT."
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique“Infrastructure analysis identified 112 Cloudflare Workers domains registered between January 2025 and January 2026…”
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom remote access trojan previously reported in SloppyLemming tooling (no additional capabilities described in this content).
Custom remote access trojan referenced as previously used by SloppyLemming; not analyzed in detail in this report’s described intrusion chains.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.