| | | SMOKEDHAM | [] | win.smokedham | [] | 2026-06-19 | | | |
| | | Hunters International | [] | win.hunters_international | ['Storm-0501'] | 2026-06-19 | | | |
| | | BADBOX | [] | apk.badbox | [] | 2026-06-19 | | | |
| | | FAKEUPDATES | ['FakeUpdate', 'GhoLoader', 'SocGholish'] | js.fakeupdates | ['GOLD PRELUDE'] | 2026-06-18 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2026-06-18 | | | |
| | | SoxAgent | [] | elf.soxagent | ['SLIME88'] | 2026-06-18 | | | |
| | | GammDrop | [] | vbs.gammadrop | ['Gamaredon Group'] | 2026-06-18 | | | |
| | | GammaLoad | [] | vbs.gammaload | ['Gamaredon Group'] | 2026-06-18 | | | |
| | | Atlas RAT | [] | win.atlas_rat | ['TA4922'] | 2026-06-18 | | | |
| | | BlackSuit | [] | win.blacksuit | [] | 2026-06-18 | | | |
| | | SilentRunLoader | [] | win.silent_run_loader | ['TA4922'] | 2026-06-18 | | | |
| | | RomulusLoader | [] | win.romulus_loader | ['TA4922'] | 2026-06-18 | | | |
| | | ACR Stealer | [] | win.acr_stealer | [] | 2026-06-18 | | | |
| | | Amatera | [] | win.amatera | [] | 2026-06-18 | | | |
| | | Sisron | [] | win.sisron | [] | 2026-06-18 | | | |
| | | GIFTEDCROOK | [] | win.giftedcrook | ['UAC-0226'] | 2026-06-18 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-06-18 | | | |
| | | JADESNOW | ['ChainedDown'] | js.jadesnow | ['WageMole'] | 2026-06-18 | | | |
| | | BACKORDER | [] | win.backorder | ['Sandworm'] | 2026-06-18 | | | |
| | | BloodAlchemy | [] | win.bloodalchemy | [] | 2026-06-18 | | | |
| | | ImprudentCook | [] | win.imprudentcook | ['Lazarus Group'] | 2026-06-18 | | | |
| | | ScoringMathTea | [] | win.scoring_math_tea | ['Lazarus Group'] | 2026-06-18 | | | |
| | | RokRAT | ['DOGCALL'] | win.rokrat | ['APT37'] | 2026-06-18 | | | |
| | | Rook | [] | win.rook | [] | 2026-06-18 | | | |
| | | Tiger RAT | [] | win.tiger_rat | ['Silent Chollima'] | 2026-06-18 | | | |
| | | BirdCall | [] | win.birdcall | ['APT37'] | 2026-06-18 | | | |
| | | BLINDINGCAN | ['AIRDRY', 'ZetaNile'] | win.blindingcan | ['Lazarus Group'] | 2026-06-18 | | | |
| | | WAVESHAPER | ['osx.curlyveiltea'] | osx.waveshaper | ['UNC1069'] | 2026-06-18 | | | |
| | | SnappyClient | ['SilabRAT'] | win.snappy_client | [] | 2026-06-18 | | | |
| | | HijackLoader | ['DOILoader', 'GHOSTPULSE', 'IDAT Loader', 'SHADOWLADDER'] | win.hijackloader | [] | 2026-06-18 | | | |
| | | AdaptixC2 | [] | win.adaptix_c2 | [] | 2026-03-10 | | | |
| | | EDR-Freeze | [] | win.edr_freeze | [] | 2026-06-10 | | | |
| | | defendnot | [] | win.defendnot | [] | 2026-06-10 | | | |
| | | StilachiRAT | [] | win.stilachi_rat | [] | 2026-06-10 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-05-13 | | | |
| | | LegionRelay | [] | ps1.legion_relay | ['GreyVibe'] | 2026-06-09 | | | |
| | | PhantomRelay | [] | ps1.phantom_relay | ['GreyVibe'] | 2026-06-09 | | | |
| | | Banana RAT | [] | ps1.banana_rat | ['SHADOW-WATER-063'] | 2026-06-09 | | | |
| | | Godzilla Webshell | [] | jsp.godzilla_webshell | [] | 2026-06-09 | | | |
| | | 404 Keylogger | ['404KeyLogger', 'Snake Keylogger'] | win.404keylogger | [] | 2026-06-09 | | | |
| | | Agent Tesla | ['AgenTesla', 'AgentTesla', 'Negasteal'] | win.agent_tesla | ['SWEED'] | 2026-06-09 | | | |
| | | RedLine Stealer | ['RECORDSTEALER'] | win.redline_stealer | [] | 2026-06-09 | | | |
| | | Formbook | ['win.xloader'] | win.formbook | ['SWEED', 'Cobalt'] | 2026-06-09 | | | |
| | | PixyNetLoader | [] | win.pixynet_loader | ['APT28'] | 2026-06-10 | | | |
| | | LOTUSLITE | [] | win.lotuslite | ['MUSTANG PANDA'] | 2026-06-09 | | | |
| | | DPAPILoader | [] | win.dpapi_loader | ['Lazarus Group'] | 2026-06-09 | | | |
| | | RemotePE | [] | win.remotepe | ['Lazarus Group'] | 2026-06-09 | | | |
| | | SILENTLOOP | [] | ps1.silentloop | [] | 2026-06-09 | | | |
| | | AGINGFLY | [] | win.agingfly | [] | 2026-06-09 | | | |
| | | Overlord RAT | [] | win.overlord | [] | 2026-06-09 | | | |
| | | Havoc | ['Havokiz'] | win.havoc | [] | 2026-06-09 | | | |
| | | xmrig | [] | win.xmrig | [] | 2026-06-09 | | | |
| | | Chisel | [] | win.chisel | [] | 2026-06-09 | | | |
| | | Shai-Hulud | [] | js.shai_hulud | [] | 2026-06-09 | | | |
| | | RecJS | [] | js.recjs | [] | 2026-06-09 | | | |
| | | C0XMO | [] | elf.c0xmo | [] | 2026-06-08 | | | |
| | | Bashlite | ['gayfgt', 'Gafgyt', 'qbot', 'torlus', 'lizkebab'] | elf.bashlite | [] | 2026-06-08 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2026-05-27 | | | |
| | | StoatWaffle | [] | js.stoatwaffle | [] | 2026-03-27 | | | |
| | | COMPOOD | [] | elf.compood | [] | 2026-06-08 | | | |
| | | Proslikefan | [] | js.proslikefan | [] | 2026-06-03 | | | |
| | | Azorult | ['PuffStealer', 'Rultazo'] | win.azorult | ['The Gorgon Group'] | 2026-06-02 | | | |
| | | IcedID | ['BokBot', 'IceID'] | win.icedid | ['GOLD CABIN', 'Lunar Spider'] | 2026-06-02 | | | |
| | | Gozi | ['CRM', 'Gozi CRM', 'Papras', 'Snifula', 'Ursnif'] | win.gozi | [] | 2026-06-02 | | | |
| | | ISFB | ['Gozi ISFB', 'IAP', 'Pandemyia'] | win.isfb | ['GOLD CABIN'] | 2026-06-02 | | | |
| | | LOLSnif | [] | win.lolsnif | [] | 2026-06-02 | | | |
| | | SUNBURST | ['Solorigate'] | win.sunburst | ['APT 29', 'UNC2452'] | 2026-06-02 | | | |
| | | TEARDROP | [] | win.teardrop | ['UNC2452'] | 2026-06-02 | | | |
| | | Calfbot | [] | sh.calfbot | ['[Unnamed group]'] | 2026-06-02 | | | |
| | | Metaencryptor | [] | win.metaencryptor | [] | 2026-06-02 | | | |
| | | GRUNT | ['Covenant'] | win.grunt | [] | 2026-06-02 | | | |
| | | MiniFast | [] | win.minifast | ['UNC1549'] | 2026-06-02 | | | |
| | | ThemeForestRAT | ['TALLSHIP'] | win.theme_forest_rat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | POOLRAT | ['SIMPLESEA', 'SIMPLETEA'] | osx.poolrat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | SimpleTea | ['PondRAT', 'SimplexTea'] | elf.simpletea | ['Lazarus Group'] | 2026-06-02 | | | |
| | | PylangGhost | ['ICEBITE.PYTHON', 'WeaselStore'] | py.pylangghost | ['WageMole'] | 2026-06-02 | | | |
| | | JFMBackdoor | [] | win.jfmbackdoor | ['Calypso'] | 2026-06-01 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2026-06-01 | | | |
| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2026-05-27 | | | |
| | | ValleyRAT | ['Winos'] | win.valley_rat | [] | 2026-05-27 | | | |
| | | Mirax | ['Astrinox', 'Mirax Bot', 'MiraxRAT'] | apk.mirax | [] | 2026-05-27 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2026-05-27 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2026-05-19 | | | |
| | | RemoteX | [] | win.remotex | [] | 2026-05-22 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | ['CoralRaider'] | 2026-05-21 | | | |
| | | LockBit | [] | elf.lockbit | [] | 2026-05-21 | | | |
| | | LockBit | ['ABCD Ransomware'] | win.lockbit | [] | 2026-05-21 | | | |
| | | PhantomCore | [] | win.phantomcore | [] | 2026-05-21 | | | |
| | | Payload | [] | win.payload | [] | 2026-05-21 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT17', 'APT23', 'APT41', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA', 'Webworm'] | 2026-05-21 | | | |
| | | Gentlemen | [] | win.gentlemen | ['The Gentlemen'] | 2026-05-21 | | | |
| | | TONESHELL | [] | win.toneshell | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-05-21 | | | |
| | | FINALDRAFT | [] | win.finaldraft | [] | 2026-05-21 | | | |
| | | VShell | [] | win.vshell | [] | 2026-05-21 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2026-05-21 | | | |
| | | Slopoly | [] | ps1.slopoly | ['Hive0163'] | 2026-05-20 | | | |
| | | Lorem Ipsum | [] | win.lorem_ipsum | [] | 2026-05-20 | | | |
| | | TCLBANKER | [] | win.tclbanker | [] | 2026-05-20 | | | |
| | | DragonBreath | [] | win.dragonbreath | [] | 2026-05-20 | | | |