Loading malware…
RAVENSHELL is a reverse-shell malware/stager observed by CERT-UA in a 2026 campaign tracked as UAC-0247 targeting Ukrainian local governments, municipal healthcare institutions, representatives of the Defense Forces of Ukraine, and FPV drone operators. In the documented intrusion chains, it is used during the initial access or staging phase as a TCP reverse shell analogue. RAVENSHELL establishes a TCP connection to a management or command-and-control server, encrypts traffic with a 9-byte XOR key, and executes commands on the compromised Windows host via cmd.exe/CMD. CERT-UA reporting also notes that on first connection it sends an XOR-encrypted "Connected!" message. The broader campaign used phishing themed around humanitarian aid, malicious archives containing LNK files, HTA-based execution via mshta.exe, scheduled tasks, DLL side-loading, and multi-stage loaders, with related malware and tooling including AGINGFLY and SILENTLOOP. High-confidence behavior directly attributed to RAVENSHELL in the provided content is limited to its role as a TCP reverse shell stager, XOR-encrypted TCP communications, and remote command execution through CMD.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key and communicates with the management server through CMD.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
... забезпечує виконання команд ... а також виконання команд за допомогою CMD.
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key and communicates with the management server through CMD.
A TCP connection encrypted using the XOR cipher is established to the C2 server
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key
... HTA-файл ... забезпечує ... завантаження і запуск EXE-файлу ... На етапі подальшого закріплення в системі ... на комп’ютер довантажується програмний засіб AGINGFLY.
... RAVENSHELL ... шифрування трафіку з використанням 9-байтового XOR ... Комунікація із сервером управління ... додатково шифрується за алгоритмом AES-CBC зі статичним ключем.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.