Loading story…
Researchers and antivirus vendors documented NetWire/Wirenet/NetWiredRC as a cross-platform backdoor affecting Linux and macOS, with capabilities including keylogging and theft of passwords from browsers and applications such as Firefox, Chrome, Chromium, Opera, Thunderbird, SeaMonkey, and Pidgin. Doctor Web reported that the malware copied itself into a user’s home directory and communicated with a command-and-control server at 212.7.208.65 using AES encryption, while malware-analysis records showed Linux ELF and macOS samples widely detected under multiple family names including Wirenet, NetWeirdRC, NetWiredRC, and Sabpab.
Further analysis tied the malware family to a custom encrypted TCP command-and-control protocol and showed it being used in campaigns linked to Silver Spaniel 419 scammers. Palo Alto Networks Unit 42 reverse engineered the protocol used by the NetWire RAT, finding that it used AES-256, attacker-selected static passwords, a seed exchange to derive separate session keys, and OFB mode for traffic encryption. The researchers released a decoder for NetWire 1.5c that can decrypt captured C2 traffic and reveal attacker-issued commands when responders have the infected client IP, malware port, and encryption password, giving incident responders a practical way to inspect NetWire activity during investigations.
Pull IOCs and campaign context straight into your stack.
10 events from the most recent confirmed update back to the earliest known activity.
Red Canary published a technical analysis of the Linux variant of NetWire RAT, detailing ELF-based execution, persistence via XDG autostart .desktop files and crontabs, and observed artifacts such as self-copying to a hidden folder and creation of likely mutex and C2 configuration files. The report also attributed the sample to NetWire through VirusTotal detections, string overlap with prior macOS analysis, and alignment with NetWire documentation and release notes.
In November 2019, Proofpoint uncovered low-volume phishing campaigns delivering NetWire RAT with Bulgarian-language lures and geofencing that only served payloads to victims with Bulgarian IP addresses. The activity later expanded into additional related campaigns through 2020, using Word macros, certutil, and shared NetWire configuration elements including a common C2 domain and password.
Mandiant published analysis of a NETWIRE phishing campaign that used a VBS initial vector, PowerShell-based fileless execution, and process hollowing to deploy the malware. The report detailed credential-theft and surveillance capabilities and released host and network indicators including MD5 dac4ed7c1c56de7d74eb238c566637aa and multiple C2 endpoints.
Palo Alto Networks Unit 42 published a report on July 22 about the evolution of Silver Spaniel 419 scammers, noting their use of the NetWire remote administration tool in operations.
CIRCL published technical report TR-23 analyzing NetWiredRC malware, which Palo Alto later cited as documenting a complete list of NetWire commands.
On December 7, 2012, two more NetWiredRC-related samples—one Linux ELF and one macOS binary—were analyzed, with numerous antivirus vendors classifying them as backdoors or trojans under WireNet/NetWeird/NetWiredRC names.
In November and December 2012, malware samples associated with WireNet/NetWeird/NetWiredRC were analyzed and detected by multiple antivirus engines, showing active recognition of Linux and macOS variants in the wild.
On August 22, 2012, Doctor Web reported Mac.BackDoor.Wirenet.1, describing it as a cross-platform backdoor for Linux and Mac OS X that steals passwords and logs keystrokes while communicating with a C2 server over AES-encrypted traffic.
Unit 42 reverse engineered NetWire's encrypted TCP protocol and released a decoder tool that can decrypt captured NetWire traffic and reveal attacker-issued commands for incident responders.
McAfee published a report describing NetWire RAT as the malware behind recent targeted attacks, adding campaign-focused reporting on the threat's operational use. This represents a new documented use of NetWire beyond the earlier sample analyses and technical reporting already in the timeline.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 44 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
12 references tracked. Mallory keeps watching after this page renders.
proofpoint.com
Open sourceredcanary.com
Open sourcemandiant.com
Open sourceattack.mitre.org
Open sourcecontagiodump.blogspot.com
Open sourcenews.drweb.com
Open sourcebrighttalk.com
Open sourcesecuringtomorrow.mcafee.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**NetWire** is a commodity remote-access trojan active since at least 2014 and used by financially motivated and nation-state actors. Elastic Security Labs reported increased telemetry prevalence in the second half of 2022 and released tooling to extract the malware's dynamically embedded configuration, enabling defenders to identify its command-and-control (C2) infrastructure and host-specific settings. The extractor decrypts NetWire’s RC4-protected configuration to recover C2 IP addresses and domains, installation and keylogger-log paths, host identifiers, mutexes, persistence settings, and communications-encryption parameters. NetWire can establish persistence through Registry Run Keys/Startup Folder mechanisms (MITRE ATT&CK `T1547.014`); defenders should hunt for its recovered indicators and persistence artifacts and deploy YARA detections covering NetWire mutexes, keylogging strings, and related binary artifacts.
Aug 26, 2026
U.S., Croatian, and Swiss authorities disrupted the long-running **NetWire** remote access trojan operation by seizing the `worldwiredlabs[.]com` sales domain, arresting alleged operator Mario Zanko in Croatia, and taking related infrastructure offline in Switzerland. The U.S. Department of Justice said the FBI investigated the malware distributor from 2020, including undercover purchases and analysis of NetWire’s builder tool, before obtaining the seizure warrant. NetWire had been marketed since 2012 as cross-platform remote administration software, but investigators said it was widely used for credential theft, keystroke logging, remote device control, fraud, data breaches, and intrusions affecting sectors including healthcare and banking. Security research tied NetWire to multiple criminal campaigns and customized variants long before the takedown. Avast documented **WiryJMPer**, an obfuscated dropper disguised as cryptocurrency wallet software that decrypted and launched a NetWire payload while establishing persistence on infected Windows systems. VMware also analyzed a **HYDSEVEN** variant that altered NetWire’s command-and-control authentication and encryption, showing how threat actors adapted the malware for tailored operations. The malware had also targeted macOS users and appeared in broader phishing and exploit-driven campaigns, underscoring NetWire’s longevity and flexibility across platforms.
Aug 15, 2026
Human rights defenders in India were targeted in a coordinated spearphishing operation that used impersonation lures and links hosted on Firefox Send to deliver **NetWire** spyware to Windows systems. Amnesty International and Citizen Lab said at least nine activists, lawyers, academics, and a journalist connected to advocacy or legal work around the **Bhima Koregaon 11** were targeted between January and October 2019, in what researchers assessed was an unlawful surveillance effort rather than ordinary cybercrime. Technical analysis tied the activity to NetWire payloads communicating with `researchplanet.zapto[.]org` over port `1810`, and the report noted that some of the same individuals had also previously been targeted with **Pegasus** spyware. A separate but related campaign described by Cisco Talos showed continued use of **NetWireRAT** in targeted attacks across the Indian subcontinent, this time aimed at Indian government employees and military personnel. Active since late 2020, the operation used malicious Office documents, archives, compromised websites, and fake domains, with lures themed around Indian government matters such as the **Kavach** two-factor authentication application; operators also deployed **WarzoneRAT**, persistence mechanisms, process hollowing, and custom file-enumerator malware. Talos said the tactics and lures resembled activity linked to **Transparent Tribe** and **SideCopy**, highlighting sustained use of commercial remote-access malware in espionage-focused campaigns against Indian civil society and state-linked targets.
Aug 14, 2026