Loading story…
An international law enforcement operation disrupted the infrastructure behind WarZone RAT, a remote access trojan sold as a malware service and used to covertly access victims’ computers. Led by the FBI with support from Europol and the Joint Cybercrime Action Taskforce, the action seized multiple domains linked to the malware marketplace, secured servers in several countries, and led to the arrests of two suspects in Malta and Nigeria accused of selling the malware and supporting criminal customers.
WarZone RAT has been widely analyzed as a credential-stealing and surveillance tool typically spread through phishing and social engineering. Researchers have documented capabilities including file browsing, screenshot capture, keystroke logging, password theft, webcam monitoring, and delivery of additional malware, as well as configuration data hidden in the PE .bss section and protected with RC4-based encryption, including both standard and modified RC4 variants used to conceal command-and-control settings.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
On 7 February, authorities arrested two suspects in Malta and Nigeria accused of selling Warzone RAT and supporting criminal customers who used the malware.
A technical analysis documented two Warzone RAT variants in circulation: one using standard RC4 and another using a modified RC4 routine to decrypt stored configuration data from the PE .bss section.
OpenAnalysis published research on WarZone RAT configuration extraction and analysis, documenting the malware family and its configuration handling.
An FBI-led international operation, supported by Europol and J-CAT, seized several domains used to sell Warzone RAT and helped secure servers hosting its infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
europol.europa.eu
Open sourcekienmanowar.wordpress.com
Open sourceresearch.openanalysis.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. and international authorities dismantled key parts of the **Warzone RAT** malware ecosystem, seizing `warzone.ws` and three related domains and unsealing indictments against alleged operators and support actors in Malta and Nigeria. The U.S. Department of Justice said the malware was marketed as a remote access trojan capable of browsing files, capturing screenshots, logging keystrokes, stealing credentials, and covertly accessing webcams, and that FBI analysis tied the tool to attacks on victim systems in Massachusetts. Warzone RAT had been widely distributed through malicious **Office documents** and multi-stage infection chains using JavaScript and PowerShell, with later samples adding stealth features such as **process hollowing**, task-scheduler persistence, process injection, and a **UAC bypass** via `ComputerDefaults.exe`. Security researchers described the malware as a malware-as-a-service offering designed to evade detection while enabling surveillance and data theft on compromised Windows hosts.
Aug 15, 2026
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026
International law enforcement agencies, coordinated by Europol and Eurojust, executed a major crackdown on the infrastructures supporting the Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet. The operation, part of the ongoing Operation Endgame, resulted in the takedown of over 1,025 servers and the seizure of 20 domains used to control and distribute these malware families. Authorities also arrested the main suspect behind VenomRAT in Greece, and the dismantled infrastructure included hundreds of thousands of infected computers and millions of stolen credentials, with many victims unaware of the compromise. The operation involved law enforcement from at least nine countries and was supported by numerous private sector partners, including cybersecurity firms and threat intelligence organizations. Rhadamanthys, a modular information stealer sold as malware-as-a-service, and VenomRAT, a commodity RAT favored by threat actors like TA558, were both widely distributed through email campaigns, malvertising, and other vectors. The Elysium botnet, less well-documented, was also linked to these operations, potentially serving as a proxy network for criminal activity. The disruption has caused significant operational issues for cybercriminals, with many reporting loss of access to their command-and-control panels and servers. Authorities have advised potential victims to check if their systems were compromised and to take remediation steps, as the takedown is expected to have a substantial impact on the cybercrime ecosystem.
Jul 12, 2026