Malware1 associated actor2 associated CVEs

Gorilla RAT

Tracked since Sep 11, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns2Associated

Actors1Associated

ATT&CK15Techniques

IOCs12Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Associated CVEs

Associated vulnerabilities

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.

CVE-2021-26855via the hacker newsExploited in the wildProxyLogon — Microsoft Exchange Server Pre-Authentication SSRFAttacks mounted by [Hacking Cat] have weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855 and CVE-2026-42897) to deliver a Go-based remote access trojan dubbed Gorilla RAT. | Hacking Cat weaponized Exchange Server vulnerabilities to deliver a Go-based remote-access trojan dubbed Gorilla RAT.View vulnerability →Source ↗

CVE-2026-42897via the hacker newsExploited in the wildStored XSS in Microsoft Exchange Server Outlook Web AccessAttacks mounted by [Hacking Cat] have weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855 and CVE-2026-42897) to deliver a Go-based remote access trojan dubbed Gorilla RAT. | Hacking Cat weaponized Exchange Server vulnerabilities to deliver a Go-based remote-access trojan dubbed Gorilla RAT.View vulnerability →Source ↗

Threat actors

Associated threat actors

1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

Hacking Cat

Hacking Cat weaponized Exchange Server vulnerabilities to deliver a Go-based remote-access trojan dubbed Gorilla RAT.

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence4

Hacking Cat “weaponized vulnerabilities in Exchange servers (e.g., CVE-2021-26855 and CVE-2026-42897) to deliver” Gorilla RAT.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Gorilla RAT receives instructions allowing it to “run arbitrary commands.”

T1059.003Windows Command ShellEvidence1

Gorilla RAT поддерживает команду cmd для выполнения команды в командной строке.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Gorilla RAT закрепляется копированием себя в %LOCALAPPDATA% и ветку реестра Software\Microsoft\Windows\CurrentVersion\Run; варианты Monkey используют RunOnceEx и Winlogon\Userinit.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Stealth

1 technique

T1497Virtualization/Sandbox EvasionEvidence1

Gorilla RAT проверяет продолжительность сна, минимальный объем физической памяти, имя хоста на sandbox/vmware/qemu и процессы Wireshark, x64dbg, IDA и другие инструменты анализа.

Discovery

4 techniques

T1057Process DiscoveryEvidence2

Gorilla RAT can “enumerate processes.”

T1082System Information DiscoveryEvidence2

Gorilla RAT can “gather system information.”

T1083File and Directory DiscoveryEvidence1

Gorilla RAT поддерживает команду listdir для показа содержимого каталога.

T1497Virtualization/Sandbox EvasionEvidence1

Command and Control

6 techniques

T1071.001Web ProtocolsEvidence1

Gorilla RAT написан на Go с использованием WebSocket; после запуска расшифровывает адрес C2, регистрирует жертву и ожидает команды.

T1090ProxyEvidence2

The custom tool can tunnel network traffic, allowing attackers to remotely access systems inside a victim’s network.

T1105Ingress Tool TransferEvidence2

Gorilla RAT supports “upload/download files.”

T1219Remote Access ToolsEvidence2

Kaspersky said it discovered... a previously undocumented remote-access tool dubbed Gorilla RAT... The custom tool can tunnel network traffic, allowing attackers to remotely access systems inside a victim’s network.

T1572Protocol TunnelingEvidence1

The newly identified Gorilla RAT serves as a remote-access trojan that can tunnel network traffic.

T1573Encrypted ChannelEvidence1

Адрес C2 Gorilla RAT зашифрован побайтовым преобразованием с четырехбайтовым ключом; DLL-компоненты расшифровывают полезные нагрузки ChaCha20 и XOR.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Команда download Gorilla RAT загружает файл на C2; .NET-вариант Monkey извлекает учетные данные Outlook и отправляет их на C2.

Indicators of compromise

Observables

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

the hacker newsNews · Sep 16, 2026Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and WipersGo-based remote-access trojan that connects to a remote server, registers the victim, executes commands, enumerates processes, collects system information, transfers files, and opens or closes TCP tunnels for internal-network access.Read more ↗cysecurity newsNews · Sep 15, 2026Pro-Ukraine Hacking Cat Group Deploys New Malware Against Russian Targets - CySecurity News - Latest Information Security and Hacking IncidentsRemote-access trojan used in Hacking Cat operations. It tunnels network traffic and supports lateral movement in victim networks after compromise of Microsoft Exchange servers.Read more ↗the record mediaNews · Sep 14, 2026Pro-Ukraine Hacking Cat group deploying new malware against Russian targets | The Record from Recorded Future NewsA custom remote-access tool used after initial access to tunnel network traffic and enable remote access to systems inside a victim network.Read more ↗securelist ruNews · Sep 11, 2026Разбираем инструментарий группировки Hacking Cat (Хакерский кiт) | SecurelistA Go-based WebSocket remote-access trojan used by Hacking Cat. It establishes persistent C2 communications, registers host metadata, accepts remote commands, uploads and downloads files, executes shell commands, manages processes, enumerates directories and system information, and proxies traffic through TCP tunnels to access internal victim-network services. Some variants support VNC-based interactive control and employ sandbox/debugger-evasion checks.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matching12Match every observed IP, domain, and hash against your live telemetry.

Associated threat actors1Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilities2CVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Gorilla RAT

Tracked since Sep 11, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns2Associated

Actors1Associated

ATT&CK15Techniques

IOCs12Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure