Loading story…
Palo Alto Networks Unit 42 reported that Blackremote RAT, a newly emerged commodity remote access trojan, was advertised on underground forums by an actor using the handles Speccy and Rafiki. The malware was sold with supporting infrastructure including a builder, manager, and client component, and offered capabilities such as password recovery, keylogging, remote desktop control, scripting, and downloader functions, making it a full-featured tool for remote compromise.
Researchers said Blackremote moved quickly from sale to active use, with nearly 50 samples tied to more than 2,200 attack sessions observed against Palo Alto Networks customers within about a month of its launch. One major campaign distributed the sample doc00190910.exe by email and used the command-and-control domain renaj.duckdns[.]org at 103.200.6[.]79, accounting for more than 1,800 sessions across multiple industries worldwide. Unit 42 also said the operator behind Blackremote was an 18-year-old from Sweden and that identifying information had been provided to the relevant authorities.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
A major Blackremote campaign distributing the sample doc00190910.exe by email peaked between September 9 and September 11, 2019. The malware communicated with renaj.duckdns[.]org at 103.200.6[.]79 and ultimately accounted for more than 1,800 observed attack sessions.
Unit 42 identified Blackremote RAT as a previously undocumented commodity remote access trojan in September 2019. The report characterized it as a newly emerged malware offering with extensive surveillance and remote-control capabilities.
During the same week as the forum promotion, the actor posted a YouTube setup video for Blackremote RAT. The video description linked to speccy[.]dev and promoted the malware as fully runtime undetected while advertising a FUD crypter.
An actor using the handles Speccy and Rafiki started advertising Blackremote RAT on underground forums during the first week of September 2019. The promotion directed buyers to blackremote[.]pro and also shared the Discord handle Speccy#0100.
The domain blackremote[.]pro, used as the malware's sales site, was registered. This infrastructure later supported promotion and sales of Blackremote RAT.
Unit 42 stated that the actor behind Blackremote was an 18-year-old from Sweden and that his identity was provided to the appropriate authorities. The source does not explicitly anchor when that handoff occurred.
Within about a month of launch, Unit 42 observed nearly 50 Blackremote samples across more than 2,200 attack sessions against Palo Alto Networks customers. The activity affected organizations across multiple industries worldwide, showing the malware was already in operational use.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 49 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **WebMonitor**, a commodity remote access trojan sold on underground forums by an actor known as **Revcode**, as part of a broader shift toward **RAT-as-a-Service** offerings that bundle malware with hosted command-and-control infrastructure. Instead of requiring buyers to stand up their own servers, WebMonitor provided browser-based administration panels and customer-specific virtual hosts under domains including `revcode[.]eu` and later `wm01[.]to`, lowering the barrier to entry for less-skilled operators. Palo Alto Networks said the malware had been marketed since 2017 and was linked to more than **2,000 infection attempts** observed against customers across multiple industries worldwide. The malware was described as being written in **Visual Basic 6**, packed with **UPX**, installed in the victim's `AppData\Roaming` directory, and configured for persistence through **HKCU Run** registry keys. Researchers also noted suspicious DNS behavior in later samples and a one-off connection to a **Monero mining pool**, suggesting the author may have been testing additional capabilities. Separate reporting on **Quaverse RAT** similarly highlighted the emergence of remote-access malware sold with service-based infrastructure, underscoring how hosted C2 panels and subscription-style support are turning commodity RAT operations into easier-to-deploy criminal services.
Aug 15, 2026
Researchers reported that **Cobian RAT**, a freely advertised remote access trojan distributed on underground forums, contained a hidden backdoor planted by its original author. The malware was marketed as a basic `njRAT`-style tool with common surveillance and remote-control features, including keylogging, webcam access, screen capture, and arbitrary code execution on infected systems. Analysis found that an encrypted library inside the Cobian RAT builder allowed the author to silently take over machines infected by downstream operators and even lock those operators out of their own campaigns. The covert component retrieved a command-and-control address from a preset Pastebin page, giving the author centralized control and effectively turning other criminals’ distribution activity into a **crowdsourced botnet-building scheme**.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026