Loading story…
Canadian authorities executed search warrants at a Greater Toronto Area residence as part of a coordinated investigation into Orcus RAT, working with the FBI and Australian Federal Police. The CRTC and RCMP National Division said the case was triggered by tips from private cybersecurity firms and involves parallel investigations into remote access trojan technology used to gain unauthorized access to computers, steal personal information, and deploy additional malware. Reporting identified the location as linked to John "Armada" Revesz, who said investigators seized backup drives containing Orcus Technologies business records, user information, and financial transaction data.
Researchers and law enforcement have long disputed claims that Orcus was a legitimate administration tool, citing capabilities commonly associated with malware, including keylogging, password theft, stealth webcam and microphone access, persistence mechanisms, remote code execution, and DDoS functions. Palo Alto Networks previously described Orcus as a low-cost, modular RAT sold commercially with plugin support, real-time scripting, anti-analysis checks, and delivery options such as spear phishing, malicious links, and drive-by downloads, concluding that it was clearly designed for cybercriminal use despite its marketing.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
On Pastebin, John “Armada” Revesz said his company had been targeted by an international search warrant executed jointly by Canadian authorities. He said backup drives containing Orcus Technologies business data, including user information and financial transactions, were seized.
Canadian authorities publicly announced that the CRTC and RCMP had executed warrants tied to an active malware investigation and said the matter was part of an international coordinated effort. They declined to identify the individuals or companies under investigation because the case was ongoing.
The Canadian Radio-television and Telecommunications Commission and the RCMP National Division each executed a warrant at a residence in the Greater Toronto Area as part of parallel investigations into remote access trojan technology. The coordinated effort involved the FBI and Australian Federal Police and was triggered by tips from private cybersecurity firms.
Fortinet reported that Orcus could use a watchdog to restart its server component if terminated and could trigger a Blue Screen of Death if someone tried to kill its process, adding to evidence of its malware-like behavior.
Palo Alto Networks Unit 42 published research describing Orcus as a modular remote access trojan with plugin support, real-time scripting, anti-analysis features, and capabilities including keylogging, password theft, webcam access, and remote code execution.
Unit 42 reported that Orcus had been sold since April 2016 for about $40 USD, marking its commercial availability to buyers. The sellers were assessed as “Sorzus” handling development and “Armada” handling sales and support.
The developer later associated with the alias “Sorzus” discussed Orcus on a hacker forum around October 2015, during the malware’s early development phase when it was initially named “Schnorchel.”
After the raid, Revesz warned users to move away from Orcus and said it should no longer be considered a safe or secure remote administration solution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourcecanada.ca
Open sourceresearchcenter.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026
U.S. and international authorities dismantled key parts of the **Warzone RAT** malware ecosystem, seizing `warzone.ws` and three related domains and unsealing indictments against alleged operators and support actors in Malta and Nigeria. The U.S. Department of Justice said the malware was marketed as a remote access trojan capable of browsing files, capturing screenshots, logging keystrokes, stealing credentials, and covertly accessing webcams, and that FBI analysis tied the tool to attacks on victim systems in Massachusetts. Warzone RAT had been widely distributed through malicious **Office documents** and multi-stage infection chains using JavaScript and PowerShell, with later samples adding stealth features such as **process hollowing**, task-scheduler persistence, process injection, and a **UAC bypass** via `ComputerDefaults.exe`. Security researchers described the malware as a malware-as-a-service offering designed to evade detection while enabling surveillance and data theft on compromised Windows hosts.
Aug 15, 2026
Threat actors distributed **Orcus RAT** and **RevengeRAT** through phishing emails masquerading as official complaints, using delivery methods that shifted from SendGrid-linked downloads to ZIP archives containing malicious batch files and script-based payloads. Reporting tied the activity to organizations worldwide, including government, financial services, IT services, and consulting sectors, and linked both malware families to the same client identifier, `CORREOS`, suggesting shared campaign infrastructure or operator overlap. Technical analysis showed heavily obfuscated infection chains built around VBS, batch, and PowerShell components, with payloads hidden in byte arrays, registry data, or protected loaders and then injected in memory using **RunPE/process hollowing** into legitimate processes such as `InstallUtil.exe`. Researchers also observed persistence through Startup shortcuts and recurring batch execution, along with command-and-control concealment using **DDNS** and Portmap services; one analyzed RevengeRAT sample communicated with `h0pe1759.ddns.net` and retained common remote-access features including screenshot capture, system profiling, and antivirus enumeration.
Aug 15, 2026