RAVENSHELL
RAVENSHELL is a reverse-shell malware/stager observed by CERT-UA in a 2026 campaign tracked as UAC-0247 targeting Ukrainian local governments, municipal healthcare institutions, representatives of the Defense Forces of Ukraine, and FPV drone operators. In the documented intrusion chains, it is used during the initial access or staging phase as a TCP reverse shell analogue. RAVENSHELL establishes a TCP connection to a management or command-and-control server, encrypts traffic with a 9-byte XOR key, and executes commands on the compromised Windows host via cmd.exe/CMD. CERT-UA reporting also notes that on first connection it sends an XOR-encrypted "Connected!" message. The broader campaign used phishing themed around humanitarian aid, malicious archives containing LNK files, HTA-based execution via mshta.exe, scheduled tasks, DLL side-loading, and multi-stage loaders, with related malware and tooling including AGINGFLY and SILENTLOOP. High-confidence behavior directly attributed to RAVENSHELL in the provided content is limited to its role as a TCP reverse shell stager, XOR-encrypted TCP communications, and remote command execution through CMD.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key and communicates with the management server through CMD.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniques... забезпечує виконання команд ... а також виконання команд за допомогою CMD.
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key and communicates with the management server through CMD.
Command and Control
4 techniquesA TCP connection encrypted using the XOR cipher is established to the C2 server
The initial access stage uses either a TCP reverse shell or RAVENSHELL, which establishes an encrypted TCP connection using a 9-byte XOR key
... HTA-файл ... забезпечує ... завантаження і запуск EXE-файлу ... На етапі подальшого закріплення в системі ... на комп’ютер довантажується програмний засіб AGINGFLY.
... RAVENSHELL ... шифрування трафіку з використанням 9-байтового XOR ... Комунікація із сервером управління ... додатково шифрується за алгоритмом AES-CBC зі статичним ключем.
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Initial access/backdoor tool that establishes an encrypted TCP connection using a 9-byte XOR key and communicates with the management server through CMD.
A TCP reverse shell used as a stager that connects back to a command server, encrypts traffic with XOR, and executes CMD commands on the victim host.
A stager/backdoor that opens a TCP reverse shell to a management server and executes received commands via cmd.exe.
A reverse-shell style malware or tool used as a stager to establish a TCP connection with the management server during the intrusion chain.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.