Loading story…
NetWire is a commodity remote-access trojan active since at least 2014 and used by financially motivated and nation-state actors. Elastic Security Labs reported increased telemetry prevalence in the second half of 2022 and released tooling to extract the malware's dynamically embedded configuration, enabling defenders to identify its command-and-control (C2) infrastructure and host-specific settings.
The extractor decrypts NetWire’s RC4-protected configuration to recover C2 IP addresses and domains, installation and keylogger-log paths, host identifiers, mutexes, persistence settings, and communications-encryption parameters. NetWire can establish persistence through Registry Run Keys/Startup Folder mechanisms (MITRE ATT&CK T1547.014); defenders should hunt for its recovered indicators and persistence artifacts and deploy YARA detections covering NetWire mutexes, keylogging strings, and related binary artifacts.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs observed increased NETWIRE prevalence in its telemetry during the second half of 2022.
Jean-Philippe Teissier authored the win_netwire_w0 memory-focused YARA rule for NetWiredRC, including the LmddnIkX mutex and keylogging-related strings.
Kevin Breen authored the win_netwire_w1 YARA rule, classifying NetWire as a remote-access trojan and matching artifacts including key-state strings and SQLite-related strings.
NETWIRE was active by at least 2014 and was used by both financially motivated and nation-state threat actors.
Felix Bilstein's yara-signator-generated win_netwire_auto rule was dated 2026-05-04. The rule detects win.netwire by requiring seven defined sequences and a file size below 416,768 bytes.
Elastic Security Labs developed an extractor that decrypts NETWIRE's RC4-protected configuration and recovers C2 infrastructure, persistence settings, host identifiers, installation paths, mutexes, and C2 encryption parameters. The research also supplied NETWIRE YARA rules and C2 IP and domain indicators derived from recently collected samples.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 66 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and antivirus vendors documented **NetWire/Wirenet/NetWiredRC** as a cross-platform backdoor affecting **Linux** and **macOS**, with capabilities including keylogging and theft of passwords from browsers and applications such as **Firefox, Chrome, Chromium, Opera, Thunderbird, SeaMonkey,** and **Pidgin**. Doctor Web reported that the malware copied itself into a user’s home directory and communicated with a command-and-control server at `212.7.208.65` using **AES** encryption, while malware-analysis records showed Linux ELF and macOS samples widely detected under multiple family names including **Wirenet**, **NetWeirdRC**, **NetWiredRC**, and **Sabpab**. Further analysis tied the malware family to a custom encrypted TCP command-and-control protocol and showed it being used in campaigns linked to **Silver Spaniel** 419 scammers. Palo Alto Networks Unit 42 reverse engineered the protocol used by the **NetWire RAT**, finding that it used **AES-256**, attacker-selected static passwords, a seed exchange to derive separate session keys, and **OFB** mode for traffic encryption. The researchers released a decoder for **NetWire 1.5c** that can decrypt captured C2 traffic and reveal attacker-issued commands when responders have the infected client IP, malware port, and encryption password, giving incident responders a practical way to inspect NetWire activity during investigations.
Aug 15, 2026
U.S., Croatian, and Swiss authorities disrupted the long-running **NetWire** remote access trojan operation by seizing the `worldwiredlabs[.]com` sales domain, arresting alleged operator Mario Zanko in Croatia, and taking related infrastructure offline in Switzerland. The U.S. Department of Justice said the FBI investigated the malware distributor from 2020, including undercover purchases and analysis of NetWire’s builder tool, before obtaining the seizure warrant. NetWire had been marketed since 2012 as cross-platform remote administration software, but investigators said it was widely used for credential theft, keystroke logging, remote device control, fraud, data breaches, and intrusions affecting sectors including healthcare and banking. Security research tied NetWire to multiple criminal campaigns and customized variants long before the takedown. Avast documented **WiryJMPer**, an obfuscated dropper disguised as cryptocurrency wallet software that decrypted and launched a NetWire payload while establishing persistence on infected Windows systems. VMware also analyzed a **HYDSEVEN** variant that altered NetWire’s command-and-control authentication and encryption, showing how threat actors adapted the malware for tailored operations. The malware had also targeted macOS users and appeared in broader phishing and exploit-driven campaigns, underscoring NetWire’s longevity and flexibility across platforms.
Aug 15, 2026
**Remcos RAT** continues to appear as a full-featured remote access implant delivered by loaders and malicious email attachments, with analysts documenting a .NET-packed sample that unpacked in memory and deployed **Remcos PRO 2.7.2**. In the observed infection chain, the malware established persistence with a scheduled task, dropped and ran a VBS script from the Temp directory, copied itself into `AppData\Roaming\remcos\`, and then removed the script. Recovered configurations exposed operational settings including execution and log paths, mutex values, encryption keys, and at least one command-and-control endpoint at `185.244.26.209`. Technical analysis shows Remcos is built for long-term control and surveillance, with capabilities spanning file, process, service, registry, window, and power management, plus remote shell access, script execution, password recovery, proxying, and download-and-execute behavior. Researchers also described a watchdog mechanism that can inject into processes such as `svchost.exe`, store the main process PID in the registry, and relaunch the implant if it is killed. The malware supports offline keylogging, screenshot capture, and audio recording, stores and decrypts configuration data from a `SETTINGS` PE resource using **RC4**, and communicates with configured C2 infrastructure using a structured packet format with optional TLS and embedded certificate material; one demonstration showed an operator issuing command `0x94` to change a Notepad window title.
Aug 15, 2026