Loading story…
Researchers uncovered VectraRAT, a previously undocumented Windows remote-access trojan sold exclusively as a malware-as-a-service subscription for $250 per month. Operated by a developer using the aliases Vectra and formerly Nyxel, the full-stack platform enables surveillance, credential theft, remote command execution, file transfer, proxying, and privilege escalation on compromised systems.
SOCRadar discovered the operation through an exposed directory containing malware samples, server-side components, licenses, and operator logs, then identified more than 10 related servers. Operators delivered VectraRAT through Amadey loader campaigns and ClickFix pages impersonating TurboTax that prompt victims to paste commands into the Windows Run dialog; logs showed 38 genuine sessions in less than a week, with corporate Windows editions—including Enterprise and Windows Server 2025—accounting for 48% of records containing operating-system data.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
SOCRadar attributed the VectraRAT service to an operator known as Vectra, previously Nyxel, and identified exposed command-and-control, operator-panel, ClickFix, and Amadey-related infrastructure. The analysis documented a custom TCP C2 protocol on port 3308, configurable post-infection callback addresses, and abuse of Windows auto-elevation utilities for elevated execution.
Researchers identified VectraRAT as a previously undocumented, Windows-focused remote-access trojan rented as a malware-as-a-service platform for $250 per month. They observed delivery via Amadey and TurboTax-themed ClickFix lures, and recorded 38 genuine victim sessions in under a week, including evidence of file theft from business systems.
SOCRadar's Threat Research Unit began investigating on June 23 after finding an exposed directory containing VectraRAT samples, server components, licenses, and operator logs. The investigation expanded to more than ten related servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcesocradar.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **WebMonitor**, a commodity remote access trojan sold on underground forums by an actor known as **Revcode**, as part of a broader shift toward **RAT-as-a-Service** offerings that bundle malware with hosted command-and-control infrastructure. Instead of requiring buyers to stand up their own servers, WebMonitor provided browser-based administration panels and customer-specific virtual hosts under domains including `revcode[.]eu` and later `wm01[.]to`, lowering the barrier to entry for less-skilled operators. Palo Alto Networks said the malware had been marketed since 2017 and was linked to more than **2,000 infection attempts** observed against customers across multiple industries worldwide. The malware was described as being written in **Visual Basic 6**, packed with **UPX**, installed in the victim's `AppData\Roaming` directory, and configured for persistence through **HKCU Run** registry keys. Researchers also noted suspicious DNS behavior in later samples and a one-off connection to a **Monero mining pool**, suggesting the author may have been testing additional capabilities. Separate reporting on **Quaverse RAT** similarly highlighted the emergence of remote-access malware sold with service-based infrastructure, underscoring how hosted C2 panels and subscription-style support are turning commodity RAT operations into easier-to-deploy criminal services.
Aug 15, 2026
Cybercriminals are actively marketing a new remote access trojan (RAT) called **Atroposia** as a plug-and-play malware-as-a-service (MaaS) platform, enabling even low-skill threat actors to launch sophisticated attacks. Atroposia is available via underground forums for a subscription fee, offering a modular toolkit that includes hidden remote desktop access, credential and cryptocurrency wallet theft, DNS hijacking, clipboard monitoring, and a local vulnerability scanner. The malware communicates with its command-and-control (C2) infrastructure over encrypted channels, employs multiple persistence mechanisms, and can bypass User Account Control (UAC) on Windows systems to escalate privileges. Its user-friendly control panel and plugin builder further lower the technical barrier for cybercriminals, making advanced attack techniques widely accessible. Researchers at Varonis and other security firms have highlighted Atroposia's role in the growing trend of turnkey criminal toolkits, which also includes platforms like SpamGPT and MatrixPDF. These toolkits bundle discovery, delivery, and evasion features into easy-to-use interfaces, allowing attackers to automate phishing campaigns, weaponize documents, and maintain stealthy, persistent access to compromised systems. Atroposia's affordability and comprehensive feature set make it a significant threat to enterprises, as it enables rapid deployment of complex attacks by a broader range of adversaries.
Jun 29, 2026
Group-IB reported that **SilabRAT** is being sold as a malware-as-a-service remote access trojan on Russian-language darkweb forums, with subscriptions advertised at **$5,000 per month** and linked to the Russian-speaking developer **`o1oo1`**. The malware has been observed in spam and **ClickFix** campaigns, where security tools often identify the packer as **HijackLoader** instead of the underlying payload, helping the RAT evade straightforward detection. Unlike centralized crimeware operations, SilabRAT uses operator-hosted infrastructure, allowing each buyer to run their own command-and-control server and keep victim data under their control. SilabRAT is built for stealthy remote access, account takeover, and cryptocurrency theft. Group-IB said its features include **HiddenVNC**, browser profile cloning, cookie theft, a Chrome **App-Bound Encryption** bypass via **`GoogleChromeElevationService`** COM elevation, **AMSI** bypass, **UAC** bypass through **`ICMLuaUtil`**, persistence with Registry Run keys and Scheduled Tasks, keylogging, clipboard monitoring, remote desktop, payload delivery, and process execution. The malware also targets crypto users by stealing wallet artifacts, attempting wallet password cracking with harvested browser credentials, and supporting crypto-clipping, while planned updates reportedly include customizable Electron injection against applications such as **Ledger Wallet** and **Trezor Suite**.
Aug 11, 2026