Loading story…
U.S. and international authorities dismantled key parts of the Warzone RAT malware ecosystem, seizing warzone.ws and three related domains and unsealing indictments against alleged operators and support actors in Malta and Nigeria. The U.S. Department of Justice said the malware was marketed as a remote access trojan capable of browsing files, capturing screenshots, logging keystrokes, stealing credentials, and covertly accessing webcams, and that FBI analysis tied the tool to attacks on victim systems in Massachusetts.
Warzone RAT had been widely distributed through malicious Office documents and multi-stage infection chains using JavaScript and PowerShell, with later samples adding stealth features such as process hollowing, task-scheduler persistence, process injection, and a UAC bypass via ComputerDefaults.exe. Security researchers described the malware as a malware-as-a-service offering designed to evade detection while enabling surveillance and data theft on compromised Windows hosts.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Authorities arrested Daniel Meli in Malta and Prince Onyeoziri Odinakachi in Nigeria in a coordinated international operation targeting alleged Warzone RAT sales and support actors.
A federal grand jury in the District of Massachusetts indicted Prince Onyeoziri Odinakachi for allegedly conspiring to support computer intrusion offenses connected to Warzone RAT.
A federal grand jury in the Northern District of Georgia indicted Daniel Meli on charges tied to allegedly selling and supporting Warzone RAT and related malware services.
Uptycs said it had previously identified WarzoneRAT using a Windows User Account Control bypass technique via ComputerDefaults.exe in November 2020.
Charging documents allege that since at least 2012, Daniel Meli offered malware products and services to cybercriminals through online hacking forums, including selling Warzone RAT and previously Pegasus RAT.
The U.S. Department of Justice announced an international operation that seized warzone.ws and three related domains used to sell Warzone RAT, with coordination through Europol and assistance from multiple countries.
Uptycs analyzed a WarzoneRAT infection chain delivered through a malicious document, JavaScript, and PowerShell, with the malware executed through process hollowing for defense evasion and persistence.
A Quick Heal blog post described Warzone RAT as a trojan malware that steals data and is triggered from various Office documents.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceuptycs.com
Open sourceblogs.quickheal.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An international law enforcement operation disrupted the infrastructure behind **WarZone RAT**, a remote access trojan sold as a malware service and used to covertly access victims’ computers. Led by the FBI with support from Europol and the Joint Cybercrime Action Taskforce, the action seized multiple domains linked to the malware marketplace, secured servers in several countries, and led to the arrests of two suspects in Malta and Nigeria accused of selling the malware and supporting criminal customers. WarZone RAT has been widely analyzed as a credential-stealing and surveillance tool typically spread through phishing and social engineering. Researchers have documented capabilities including file browsing, screenshot capture, keystroke logging, password theft, webcam monitoring, and delivery of additional malware, as well as configuration data hidden in the PE `.bss` section and protected with RC4-based encryption, including both standard and modified RC4 variants used to conceal command-and-control settings.
Aug 15, 2026
An international law enforcement operation disrupted the **Imminent Monitor** remote access trojan (RAT), a malware tool marketed online as legitimate remote administration software but widely used for cybercrime. Researchers at Palo Alto Networks Unit 42 said they collected more than **65,000** samples and observed over **115,000** attacks tied to the malware, which included stealth and persistence features, antivirus-evasion tooling, hidden keylogging, and later cryptocurrency-mining capability. Investigators linked the malware’s developer, known as **"Shockwave™"**, to Australia and referred the case to the Australian Federal Police, which worked with partners including the FBI and Canada’s CRTC to support **Operation Cepheus** and disable the RAT’s licensing infrastructure. The takedown exposed purchaser records and triggered enforcement against suspected users, with authorities reporting **85 warrants**, **434 device seizures**, and **13 arrests**. In the UK, that investigation led to the conviction of **Scott Cowley** of St Helens, Merseyside, who was sentenced to two years in prison after forensic analysis found he had used Imminent Monitor to hijack the webcams of three women and secretly record them in their bedrooms. The case underscored how a commodity RAT sold to thousands of customers was used not only for intrusion and surveillance, but also for sexual abuse and other criminal activity.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026