| | | SUNBURST | ['Solorigate'] | win.sunburst | ['APT 29', 'UNC2452'] | 2026-06-02 | | | |
| | | TEARDROP | [] | win.teardrop | ['UNC2452'] | 2026-06-02 | | | |
| | | Azorult | ['PuffStealer', 'Rultazo'] | win.azorult | ['The Gorgon Group'] | 2026-06-02 | | | |
| | | LOLSnif | [] | win.lolsnif | [] | 2026-06-02 | | | |
| | | ISFB | ['Gozi ISFB', 'IAP', 'Pandemyia'] | win.isfb | ['GOLD CABIN'] | 2026-06-02 | | | |
| | | Gozi | ['CRM', 'Gozi CRM', 'Papras', 'Snifula', 'Ursnif'] | win.gozi | [] | 2026-06-02 | | | |
| | | IcedID | ['BokBot', 'IceID'] | win.icedid | ['GOLD CABIN', 'Lunar Spider'] | 2026-06-02 | | | |
| | | Calfbot | [] | sh.calfbot | ['[Unnamed group]'] | 2026-06-02 | | | |
| | | Metaencryptor | [] | win.metaencryptor | [] | 2026-06-02 | | | |
| | | GRUNT | ['Covenant'] | win.grunt | [] | 2026-06-02 | | | |
| | | MiniFast | [] | win.minifast | ['UNC1549'] | 2026-06-02 | | | |
| | | ThemeForestRAT | ['TALLSHIP'] | win.theme_forest_rat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | POOLRAT | ['SIMPLESEA', 'SIMPLETEA'] | osx.poolrat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | SimpleTea | ['PondRAT', 'SimplexTea'] | elf.simpletea | ['Lazarus Group'] | 2026-06-02 | | | |
| | | JADESNOW | ['ChainedDown'] | js.jadesnow | ['WageMole'] | 2026-06-02 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-05-13 | | | |
| | | PylangGhost | ['ICEBITE.PYTHON', 'WeaselStore'] | py.pylangghost | ['WageMole'] | 2026-06-02 | | | |
| | | JFMBackdoor | [] | win.jfmbackdoor | ['Calypso'] | 2026-06-01 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2026-06-01 | | | |
| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2026-05-27 | | | |
| | | ValleyRAT | ['Winos'] | win.valley_rat | [] | 2026-05-27 | | | |
| | | Mirax | ['Astrinox', 'Mirax Bot', 'MiraxRAT'] | apk.mirax | [] | 2026-05-27 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2026-05-27 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2026-05-27 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2026-05-19 | | | |
| | | RemoteX | [] | win.remotex | [] | 2026-05-22 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | ['CoralRaider'] | 2026-05-21 | | | |
| | | LockBit | [] | elf.lockbit | [] | 2026-05-21 | | | |
| | | LockBit | ['ABCD Ransomware'] | win.lockbit | [] | 2026-05-21 | | | |
| | | PhantomCore | [] | win.phantomcore | [] | 2026-05-21 | | | |
| | | LOTUSLITE | [] | win.lotuslite | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | Payload | [] | win.payload | [] | 2026-05-21 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT17', 'APT23', 'APT41', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA', 'Webworm'] | 2026-05-21 | | | |
| | | Gentlemen | [] | win.gentlemen | ['The Gentlemen'] | 2026-05-21 | | | |
| | | TONESHELL | [] | win.toneshell | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-05-21 | | | |
| | | FINALDRAFT | [] | win.finaldraft | [] | 2026-05-21 | | | |
| | | VShell | [] | win.vshell | [] | 2026-05-21 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2026-05-21 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-05-19 | | | |
| | | Slopoly | [] | ps1.slopoly | ['Hive0163'] | 2026-05-20 | | | |
| | | Lorem Ipsum | [] | win.lorem_ipsum | [] | 2026-05-20 | | | |
| | | TCLBANKER | [] | win.tclbanker | [] | 2026-05-20 | | | |
| | | DragonBreath | [] | win.dragonbreath | [] | 2026-05-20 | | | |
| | | PicassoLoader | [] | win.picasso_loader | ['Ghostwriter'] | 2026-05-19 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2026-05-19 | | | |
| | | Payload | [] | elf.payload | [] | 2026-05-19 | | | |
| | | Lalia Ransomware | [] | win.lalia_ransomware | [] | 2026-05-19 | | | |
| | | HijackLoader | ['DOILoader', 'GHOSTPULSE', 'IDAT Loader', 'SHADOWLADDER'] | win.hijackloader | [] | 2026-05-19 | | | |
| | | Black Basta | ['no_name_software'] | win.blackbasta | ['GOLD REBELLION', 'STAC5143', 'Storm-0506', 'Storm-0826', 'TA2101', 'UNC3973', 'UNC4393'] | 2026-05-19 | | | |
| | | BanPolMex RAT | [] | win.banpolmex | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Bart | [] | win.bart | [] | 2022-02-14 | | | |
| | | BatchWiper | [] | win.batchwiper | [] | 2021-10-05 | | | |
| | | Batel | [] | win.batel | [] | 2020-04-21 | | | |
| | | BazarBackdoor | ['BEERBOT', 'KEGTAP', 'Team9Backdoor', 'bazaloader', 'bazarloader'] | win.bazarbackdoor | ['UNC1878'] | 2023-10-16 | | | |
| | | BBSRAT | [] | win.bbsrat | [] | 2023-06-23 | | | |
| | | BEARDSHELL | [] | win.beardshell | ['APT28'] | 2026-03-11 | | | |
| | | win.beast | ['blacklockbit'] | win.beast | [] | 2025-04-28 | | | |
| | | BEATDROP | [] | win.beatdrop | ['APT29'] | 2024-02-02 | | | |
| | | Bedep | [] | win.bedep | [] | 2026-05-05 | | | |
| | | Bee | [] | win.bee | [] | 2021-01-29 | | | |
| | | BeepService | [] | win.beepservice | [] | 2020-05-27 | | | |
| | | BernhardPOS | [] | win.bernhardpos | [] | 2022-09-19 | | | |
| | | Bert | [] | win.bert | [] | 2025-09-23 | | | |
| | | BetaBot | ['Neurevt'] | win.betabot | [] | 2026-04-22 | | | |
| | | BHunt | [] | win.bhunt | [] | 2022-02-26 | | | |
| | | BH_A006 | [] | win.bh_a006 | [] | 2024-11-25 | | | |
| | | BiBi | ['BiBi-Windows'] | win.bibi | ['Void Manticore'] | 2024-12-16 | | | |
| | | BI_D Ransomware | [] | win.bid_ransomware | [] | 2019-08-12 | | | |
| | | BillGates | [] | win.billgates | [] | 2023-08-31 | | | |
| | | Biscuit | ['zxdosml'] | win.biscuit | ['Comment Crew'] | 2018-02-10 | | | |
| | | BISTROMATH | [] | win.bistromath | ['Lazarus Group', 'Silent Chollima'] | 2023-09-22 | | | |
| | | BITSloth | [] | win.bitsloth | [] | 2024-08-29 | | | |
| | | Bitsran | ['SHADYCAT'] | win.bitsran | ['Lazarus Group'] | 2019-08-26 | | | |
| | | Bitter RAT | [] | win.bitter_rat | [] | 2025-11-26 | | | |
| | | BitRAT | [] | win.bit_rat | [] | 2025-08-29 | | | |
| | | BKA Trojaner | ['bwin3_bka'] | win.bka_trojaner | [] | 2018-05-28 | | | |
| | | BlackByte | [] | win.blackbyte | [] | 2026-03-02 | | | |
| | | BlackCat | ['ALPHV', 'Noberus'] | win.blackcat | ['Alpha Spider', 'RansomHub', 'Vanilla Tempest'] | 2026-01-12 | | | |
| | | BLACKCOFFEE | ['PNGRAT', 'gresim', 'ZoxPNG'] | win.blackcoffee | ['APT41', 'Aurora Panda', 'Leviathan'] | 2025-04-17 | | | |
| | | BlackEnergy | [] | win.blackenergy | ['Sandworm'] | 2024-04-23 | | | |
| | | BlackLotus | [] | win.blacklotus | [] | 2023-12-27 | | | |
| | | BlackMagic | [] | win.blackmagic | [] | 2022-12-08 | | | |
| | | BlackMatter | [] | win.blackmatter | [] | 2025-03-21 | | | |
| | | BlackPOS | ['Kaptoxa', 'MMon', 'POSWDS', 'Reedum'] | win.blackpos | [] | 2020-10-05 | | | |
| | | BlackShades | [] | win.blackshades | [] | 2020-05-23 | | | |
| | | BlackSoul | [] | win.blacksoul | [] | 2021-01-10 | | | |
| | | BlackSuit | [] | win.blacksuit | [] | 2025-07-28 | | | |
| | | BleachGap | [] | win.bleachgap | [] | 2022-08-28 | | | |
| | | BLINDINGCAN | ['AIRDRY', 'ZetaNile'] | win.blindingcan | ['Lazarus Group'] | 2025-09-15 | | | |
| | | BlindEDR | [] | win.blind_edr | [] | 2025-10-23 | | | |
| | | Blister | ['COLORFAKE'] | win.blister | [] | 2023-11-14 | | | |
| | | BLUEHAZE | [] | win.bluehaze | [] | 2022-12-02 | | | |
| | | BLUELIGHT | [] | win.bluelight | ['APT37'] | 2023-05-24 | | | |
| | | BlueNoroff | [] | win.bluenoroff | ['Lazarus Group'] | 2023-08-14 | | | |
| | | BOATLAUNCH | [] | win.boatlaunch | ['FIN7'] | 2022-04-07 | | | |
| | | Boaxxe | [] | win.boaxxe | [] | 2018-03-26 | | | |
| | | Bohmini | [] | win.bohmini | [] | 2018-07-24 | | | |
| | | BOLDMOVE | [] | win.boldmove | [] | 2023-01-20 | | | |
| | | Bolek | ['KBOT'] | win.bolek | [] | 2020-04-06 | | | |