Loading story…
Breakglass Intelligence disclosed two previously unreported .NET remote access trojans, SheetRAT and RatonRAT, highlighting how low-cost tooling and legitimate infrastructure are lowering the barrier to cybercrime. SheetRAT was identified in MalwareBazaar samples submitted from Chile and was found to use Pinggy TCP/HTTP tunnels for command and control rather than Google Sheets, allowing traffic to blend into normal encrypted connections to pinggy.link. Researchers said the malware is distributed as an openly available GitHub builder and includes 32 plugins covering surveillance, credential theft, persistence, lateral movement, crypto mining, DDoS, and proxying; analysis also recovered version 2.6.4, persistence paths, anti-analysis checks, and masquerade filenames from its obfuscated code.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On April 1, 2026, Breakglass Intelligence published a report on the previously unreported RatonRAT malware-as-a-service platform. The analysis tied the malware to a developer using the aliases "silly," "sillycs," and "sillyisafed," identified live C2 servers in the Netherlands, United States, and Germany, and revealed a separate private v4.0.0 branch.
On April 1, 2026, Breakglass Intelligence published the first public analysis of SheetRAT, describing its use of Pinggy TCP/HTTP tunnels for command and control instead of Google Sheets. The report also documented its 32-plugin builder ecosystem, obfuscation scheme, persistence paths, and low-to-medium confidence links to a Russian-speaking developer community.
Five SheetRAT samples were submitted to MalwareBazaar from Chile between March 29 and March 31, 2026. These submissions represent the earliest concrete observed activity for the previously unreported modular .NET RAT.
Breakglass Intelligence reported that public RatonRAT release infrastructure recorded 1,668 downloads across ten releases over roughly one month, indicating growing uptake of the malware-as-a-service offering. The exact release dates were not provided, but this activity predates the April 1, 2026 publication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **BitRAT** distribution campaigns that used highly tailored social-engineering lures to infect Windows users with the commodity remote access trojan. In one campaign, attackers abused a Colombian cooperative bank’s compromised infrastructure and reused stolen customer records in malicious Excel files, indicating a real breach involving roughly **418,777** rows of sensitive data. Qualys said the operators likely exploited **SQL injection** with `sqlmap`, then used obfuscated macros, `certutil`, and `rundll32` to stage and launch BitRAT from payloads hosted on a throwaway GitHub repository. Separate reporting showed BitRAT also spread through fake **Windows 10 activators** shared on South Korean webhards, Discord, and social media, where a bogus activation tool downloaded the malware and attempted to weaken Windows Defender protections. Fortinet documented another BitRAT campaign that targeted **NFT enthusiasts**, using Hebrew-language Excel lures and Discord-hosted payloads to deliver the malware through batch scripts, PowerShell, and DLL injection into a copied `MSBuild.exe` process. Across the campaigns, BitRAT was described as a low-cost malware-as-a-service tool sold on underground forums since 2021, with capabilities including credential theft, keylogging, webcam and microphone access, hidden remote desktop (**HVNC**), file exfiltration, cryptocurrency mining, DDoS activity, and persistence via startup-folder placement or process injection. The reporting highlights how BitRAT operators increasingly combine stolen data, topical themes, and pirated software bait with legitimate services such as GitHub and Discord to improve infection success.
Aug 15, 2026
Security researchers reported that **Brute Ratel C4** (`BRC4`/`BRc4`), a commercial adversary-simulation and command-and-control framework built to evade EDR and antivirus tools, has been adopted by malicious actors and observed in real intrusions. Palo Alto Networks Unit 42 analyzed a sample delivered in an ISO using an **APT29-like chain**—`LNK` file, legitimate `OneDriveUpdater.exe`, and DLL search-order hijacking—to load a malicious `Version.dll`, decrypt shellcode, and inject the payload into `RuntimeBroker.exe`. The implant communicated over TCP 443 with AWS-hosted infrastructure using a self-signed certificate impersonating Microsoft, and Unit 42 linked related artifacts to **41 malicious IPs**, multiple BRc4 samples, and victims in North and South America. Separate reporting tied Brute Ratel activity to **Black Basta** operations using **QBot** for delivery, while an Airbus Protect incident-response case documented a newer packed `Win.dll` variant using anti-debugging, API hashing, dynamic syscalls, and RC4-encrypted outbound traffic to a configured C2 endpoint.
Aug 15, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026