| | | StrelaStealer | [] | win.strelastealer | [] | 2025-05-21 | | | |
| | | Scavenger | ['scavenger', 'SCVNGR', 'scvngr'] | win.scavenger | [] | 2025-07-24 | | | |
| | | KV | [] | sh.kv | ['Volt Typhoon'] | 2025-07-24 | | | |
| | | DEVMAN | [] | win.devman | ['[Unnamed group]'] | 2025-07-24 | | | |
| | | Pearl Stealer | [] | osx.pearl_stealer | [] | 2025-07-24 | | | |
| | | Lumma Stealer | ['LummaC2 Stealer'] | win.lumma | ['Angry Likho'] | 2025-07-24 | | | |
| | | Dosia | ['DDOSIA'] | win.dosia | ['NoName057(16)'] | 2025-07-24 | | | |
| | | RunForestRun | ['Blackhole', 'Sutra'] | js.runforestrun | [] | 2025-07-24 | | | |
| | | GootKit | ['Waldek', 'Xswkit', 'talalpek'] | win.gootkit | [] | 2025-07-24 | | | |
| | | Lyposit | ['Lucky Locker', 'Adneukine', 'Bomba Locker'] | win.lyposit | [] | 2025-07-24 | | | |
| | | Matsnu | [] | win.matsnu | [] | 2025-07-24 | | | |
| | | Sinowal | ['Theola', 'Quarian', 'Mebroot', 'Anserin', 'Torpig'] | win.sinowal | [] | 2025-07-24 | | | |
| | | Urausy | [] | win.urausy | [] | 2025-07-24 | | | |
| | | UPAS | ['Rombrast'] | win.upas | [] | 2025-07-24 | | | |
| | | Reveton | [] | win.reveton | [] | 2025-07-24 | | | |
| | | Andromeda | ['Gamarue', 'B106-Gamarue', 'B67-SS-Gamarue', 'b66'] | win.andromeda | ['Operation C-Major'] | 2025-07-24 | | | |
| | | Citadel | [] | win.citadel | [] | 2025-07-24 | | | |
| | | XWorm | [] | win.xworm | [] | 2025-07-24 | | | |
| | | MimiKatz | [] | win.mimikatz | ['APT32', 'Anunak', 'GALLIUM'] | 2025-07-23 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2025-07-23 | | | |
| | | Latrodectus | ['BLACKWIDOW', 'IceNova', 'Latrodectus', 'Lotus'] | win.latrodectus | [] | 2025-07-14 | | | |
| | | Broomstick | ['CLEANBOOST', 'CleanUp', 'CleanUpLoader', 'Oyster'] | win.broomstick | [] | 2025-06-30 | | | |
| | | TwoFace | ['Minion', 'HighShell', 'HyperShell', 'SEASHARPEE'] | asp.twoface | ['APT27', 'APT34', 'OilRig', 'Turla', 'UNC215'] | 2025-07-22 | | | |
| | | ASPXSpy | [] | php.aspxspy | ['APT39', 'APT41', 'HAFNIUM'] | 2025-07-22 | | | |
| | | SharPyShell | ['ASPSHELL'] | win.sharpyshell | ['APT41'] | 2025-07-22 | | | |
| | | SilentPrism | [] | ps1.silent_prism | ['Larva-208'] | 2025-07-22 | | | |
| | | ColdLock | [] | win.coldlock | ['APT41'] | 2025-07-21 | | | |
| | | LAMEHUG | [] | py.lamehug | ['APT28'] | 2025-07-21 | | | |
| | | Crocodilus | [] | apk.crocodilus | [] | 2025-07-21 | | | |
| | | 8Base | [] | win.8base | [] | 2025-07-21 | | | |
| | | Phobos | [] | win.phobos | [] | 2025-07-21 | | | |
| | | Voldemort | [] | win.voldemort | [] | 2025-07-17 | | | |
| | | WhisperGate | ['PAYWIPE'] | win.whispergate | [] | 2025-07-21 | | | |
| | | Scranos | [] | win.scranos | [] | 2025-07-21 | | | |
| | | Stresspaint | [] | win.stresspaint | [] | 2025-07-21 | | | |
| | | PylangGhost | [] | py.pylangghost | ['WageMole'] | 2025-06-25 | | | |
| | | GolangGhost | [] | osx.golangghost | ['WageMole'] | 2025-06-25 | | | |
| | | FrostyFerret | [] | osx.frostyferret | ['WageMole'] | 2025-04-27 | | | |
| | | STRRAT | [] | jar.strrat | [] | 2025-07-17 | | | |
| | | Koi Loader | [] | win.koiloader | [] | 2025-05-20 | | | |
| | | Koi Stealer | [] | win.koistealer | [] | 2024-12-09 | | | |
| | | Global | ['GLOBAL GROUP'] | win.global | [] | 2025-07-15 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2025-07-16 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2025-07-16 | | | |
| | | SilentGh0st | [] | win.silentgh0st | [] | 2025-07-15 | | | |
| | | CloudEyE | ['GuLoader', 'vbdropper'] | win.cloudeye | [] | 2025-07-14 | | | |
| | | Feodo | ['Cridex', 'Bugat'] | win.feodo | [] | 2025-07-14 | | | |
| | | BellaCiao | [] | win.bellaciao | [] | 2025-07-14 | | | |
| | | Mispadu | ['URSA'] | win.mispadu | [] | 2025-07-14 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2025-06-04 | | | |
| | | HATVIBE | [] | vbs.hatvibe | ['UAC-0063'] | 2025-07-11 | | | |
| | | DownEx | [] | win.downex | ['UAC-0063'] | 2025-07-11 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | [] | 2025-07-09 | | | |
| | | BADBOX | [] | apk.badbox | [] | 2025-07-08 | | | |
| | | Amatera | [] | win.amatera | [] | 2025-07-08 | | | |
| | | HTran | ['HUC Packet Transmit Tool', 'lcx'] | win.htran | ['GALLIUM', 'UPS'] | 2025-07-08 | | | |
| | | iox | [] | win.iox | [] | 2025-07-08 | | | |
| | | reGeorg | [] | win.regeorg | [] | 2025-07-08 | | | |
| | | POORTRY | [] | win.poortry | [] | 2025-07-07 | | | |
| | | PowerNet | [] | ps1.powernet | ['FIN7'] | 2025-07-07 | | | |
| | | RevC2 | [] | win.revc2 | [] | 2025-07-07 | | | |
| | | PureLogs Stealer | [] | win.purelogs | [] | 2025-07-07 | | | |
| | | Phemedrone Stealer | ['Ov3r_Stealer'] | win.phemedrone_stealer | [] | 2025-07-07 | | | |
| | | JanelaRAT | [] | win.janela_rat | [] | 2025-07-07 | | | |
| | | SNOWLIGHT | [] | elf.snowlight | ['UNC5174'] | 2025-07-07 | | | |
| | | GOREVERSE | [] | elf.goreverse | ['UNC5174'] | 2025-07-07 | | | |
| | | AMOS | ['Atomic macOS Stealer'] | osx.amos | [] | 2025-07-07 | | | |
| | | Supper | ['SocksShell', 'ZAPCAT'] | win.supper | ['Vanilla Tempest'] | 2025-07-01 | | | |
| | | SideWalk | [] | elf.sidewalk | [] | 2025-07-02 | | | |
| | | JenX | [] | elf.jenx | [] | 2025-07-02 | | | |
| | | GOREshell | [] | elf.goreshell | [] | 2025-07-02 | | | |
| | | DarkGate | ['Meh', 'MehCrypter'] | win.darkgate | [] | 2025-07-01 | | | |
| | | EvilConwi | [] | win.evilconwi | [] | 2025-06-30 | | | |
| | | Qilin | [] | elf.qilin | [] | 2025-06-30 | | | |
| | | Skuld | ['TMPN'] | win.skuld | [] | 2025-06-30 | | | |
| | | HexaLocker | [] | win.hexalocker | [] | 2025-06-30 | | | |
| | | SpyNote | ['CypherRat'] | apk.spynote | ['OilRig'] | 2025-06-30 | | | |
| | | GIFTEDCROOK | [] | win.giftedcrook | ['UAC-0226'] | 2025-06-27 | | | |
| | | Skynet | [] | win.skynet | [] | 2025-06-26 | | | |
| | | ACR Stealer | [] | win.acr_stealer | [] | 2025-06-26 | | | |
| | | Agent Tesla | ['AgenTesla', 'AgentTesla', 'Negasteal'] | win.agent_tesla | ['SWEED'] | 2025-06-25 | | | |
| | | Formbook | ['win.xloader'] | win.formbook | ['SWEED', 'Cobalt'] | 2025-06-25 | | | |
| | | RedLine Stealer | ['RECORDSTEALER'] | win.redline_stealer | [] | 2025-06-25 | | | |
| | | Remcos | ['RemcosRAT', 'Remvio', 'Socmer'] | win.remcos | ['APT33', 'The Gorgon Group', 'UAC-0050'] | 2025-06-25 | | | |
| | | Vidar | [] | win.vidar | [] | 2025-06-25 | | | |
| | | BEARDSHELL | [] | win.beardshell | ['APT28'] | 2025-06-25 | | | |
| | | SLIMAGENT | [] | win.slimagent | ['APT28'] | 2025-06-25 | | | |
| | | MASS Logger | [] | win.masslogger | [] | 2025-06-25 | | | |
| | | AsyncRAT | [] | win.asyncrat | [] | 2025-06-25 | | | |
| | | GolangGhost | ['BitStep RAT', 'WeaselStore'] | win.golangghost | ['WageMole'] | 2025-06-25 | | | |
| | | Xloader | ['Formbook'] | osx.xloader | [] | 2025-06-25 | | | |
| | | Brute Ratel C4 | ['BOLDBADGER', 'BruteRatel'] | win.brute_ratel_c4 | [] | 2025-06-24 | | | |
| | | Ghost RAT | ['Farfli', 'Gh0st RAT', 'PCRat'] | win.ghost_rat | ['EMISSARY PANDA', 'Hurricane Panda', 'Lazarus Group', 'Leviathan', 'Red Menshen', 'Stone Panda'] | 2025-06-24 | | | |
| | | Fog | [] | win.fog | [] | 2025-06-24 | | | |
| | | Quasar RAT | ['CinaRAT', 'QuasarRAT', 'Yggdrasil'] | win.quasar_rat | ['APT33', 'Dropping Elephant', 'Stone Panda', 'The Gorgon Group'] | 2025-06-24 | | | |
| | | Meduza Stealer | [] | win.meduza | [] | 2025-06-24 | | | |
| | | Sliver | [] | win.sliver | [] | 2025-06-24 | | | |
| | | ShortLeash | [] | win.shortleash | [] | 2025-06-24 | | | |
| | | JuicyPotato | [] | win.juicy_potato | [] | 2025-06-24 | | | |
| | | Meterpreter | [] | win.meterpreter | [] | 2025-06-24 | | | |