| | | WAVESHAPER | [] | osx.waveshaper | ['UNC1069'] | 2026-04-01 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2026-03-30 | | | |
| | | Socks5 Systemz | ['ProxyBox'] | win.socks5_systemz | [] | 2026-03-30 | | | |
| | | SnappyClient | [] | win.snappy_client | [] | 2026-03-30 | | | |
| | | magecart | [] | js.magecart | ['FIN6', 'MageCart'] | 2026-03-30 | | | |
| | | StoatWaffle | [] | js.stoatwaffle | [] | 2026-03-27 | | | |
| | | PylangGhost | ['WeaselStore'] | py.pylangghost | ['WageMole'] | 2026-03-27 | | | |
| | | GolangGhost | ['BitStep RAT', 'WeaselStore'] | win.golangghost | ['WageMole'] | 2026-03-27 | | | |
| | | tsh | ['TINYSHELL'] | elf.tsh | [] | 2026-03-27 | | | |
| | | BPFDoor | ['JustForFun'] | elf.bpfdoor | ['Red Menshen'] | 2026-03-27 | | | |
| | | Kamasers | [] | win.kamasers | [] | 2026-03-27 | | | |
| | | PixyNetLoader | [] | win.pixynet_loader | ['APT28'] | 2026-03-26 | | | |
| | | JSOutProx | [] | win.jsoutprox | ['SOLAR SPIDER'] | 2024-04-08 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-03-24 | | | |
| | | Unidentified JS 007 (Zimbra Stealer) | [] | js.unidentified_007 | ['APT28'] | 2026-03-24 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-03-24 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2026-03-24 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2026-03-24 | | | |
| | | Stealc | [] | win.stealc | [] | 2026-03-10 | | | |
| | | RegPhantom | [] | win.regphantom | [] | 2026-03-23 | | | |
| | | Reynolds | [] | win.reynolds | [] | 2026-03-23 | | | |
| | | GreenBlood | [] | win.greenblood | [] | 2026-03-23 | | | |
| | | MoonRise | [] | win.moonrise | [] | 2026-03-23 | | | |
| | | Black Basta | ['no_name_software'] | win.blackbasta | ['GOLD REBELLION', 'STAC5143', 'Storm-0506', 'Storm-0826', 'TA2101', 'UNC3973', 'UNC4393'] | 2026-03-23 | | | |
| | | JADESNOW | ['ChainedDown'] | js.jadesnow | ['WageMole'] | 2026-03-13 | | | |
| | | VENON | [] | win.venon | [] | 2026-03-23 | | | |
| | | OtterCandy | ['HardHatRAT', 'UNSEENMINK'] | js.ottercandy | ['WageMole'] | 2026-03-13 | | | |
| | | ACR Stealer | [] | win.acr_stealer | [] | 2026-03-23 | | | |
| | | TOUGHPROGRESS | ['Calendarwalk'] | win.toughprogress | ['APT41'] | 2026-03-23 | | | |
| | | HijackLoader | ['DOILoader', 'GHOSTPULSE', 'IDAT Loader', 'SHADOWLADDER'] | win.hijackloader | [] | 2026-03-23 | | | |
| | | DustyHammock | [] | win.dusty_hammock | [] | 2026-03-12 | | | |
| | | MeltingClaw | [] | win.meltingclaw | [] | 2026-03-12 | | | |
| | | TransferLoader | [] | win.transferloader | [] | 2026-03-12 | | | |
| | | ROMCOM RAT | ['PEAPOD', 'SingleCamper', 'SnipBot'] | win.romcom_rat | [] | 2026-03-12 | | | |
| | | CASTLELOADER | [] | win.castleloader | [] | 2026-03-12 | | | |
| | | NightshadeC2 | ['CastleRAT'] | win.nightshade_c2 | [] | 2026-03-12 | | | |
| | | Tsundere | ['DinDoor'] | js.tsundere | ['MuddyWater'] | 2026-03-12 | | | |
| | | Qilin | [] | elf.qilin | [] | 2026-03-12 | | | |
| | | Rhadamanthys | [] | win.rhadamanthys | ['Sandworm'] | 2026-03-12 | | | |
| | | Coruna | [] | ios.coruna | [] | 2026-03-12 | | | |
| | | Matanbuchus | [] | win.matanbuchus | [] | 2026-03-12 | | | |
| | | Lumma Stealer | ['LummaC2 Stealer'] | win.lumma | ['Angry Likho'] | 2026-03-12 | | | |
| | | KadNap | [] | elf.kadnap | [] | 2026-03-11 | | | |
| | | BEARDSHELL | [] | win.beardshell | ['APT28'] | 2026-03-11 | | | |
| | | SLIMAGENT | [] | win.slimagent | ['APT28'] | 2026-03-11 | | | |
| | | X-Agent | ['splm', 'chopstick'] | win.xagent | ['APT28'] | 2026-03-11 | | | |
| | | XTunnel | ['Shunnael', 'X-Tunnel', 'xaps'] | win.xtunnel | ['APT28'] | 2026-03-11 | | | |
| | | GRUNT | ['Covenant'] | win.grunt | [] | 2026-03-11 | | | |
| | | GolangGhost | [] | osx.golangghost | ['WageMole'] | 2026-03-11 | | | |
| | | Morpheus | ['HellCat'] | win.morpheus | [] | 2026-03-11 | | | |
| | | Morpheus Loader | [] | win.morpheus_loader | [] | 2025-08-19 | | | |
| | | TrustConnect RAT | [] | win.trustconnect | [] | 2026-03-04 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2026-03-11 | | | |
| | | AstarionRAT | ['MIMICRAT'] | win.astarion_rat | [] | 2026-03-11 | | | |
| | | PUBLOAD | ['ClaimLoader', 'PUBLOAD'] | win.pubload | [] | 2025-09-23 | | | |
| | | RustyRocket | [] | win.rustyrocket | [] | 2026-03-10 | | | |
| | | Akira | ['REDBIKE'] | win.akira | ['Storm-1567'] | 2026-03-10 | | | |
| | | AdaptixC2 | [] | win.adaptix_c2 | [] | 2026-03-10 | | | |
| | | BumbleBee | ['COLDTRAIN', 'SHELLSTING', 'Shindig'] | win.bumblebee | ['EXOTIC LILY', 'GOLD CABIN', 'TA578', 'TA579'] | 2026-03-10 | | | |
| | | AMOS | ['Atomic macOS Stealer'] | osx.amos | [] | 2026-03-10 | | | |
| | | OceanLotus | [] | osx.oceanlotus | ['APT32'] | 2026-03-10 | | | |
| | | MacSpy | [] | osx.macspy | [] | 2026-03-10 | | | |
| | | Brute Ratel C4 | ['BOLDBADGER', 'BruteRatel'] | win.brute_ratel_c4 | [] | 2026-03-10 | | | |
| | | Remcos | ['RemcosRAT', 'Remvio', 'Socmer'] | win.remcos | ['APT33', 'The Gorgon Group', 'UAC-0050'] | 2026-03-10 | | | |
| | | Salvador Stealer | [] | apk.salvador | [] | 2026-03-10 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-03-04 | | | |
| | | BadPaw | [] | win.badpaw | ['APT28'] | 2026-03-04 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | ['CoralRaider'] | 2026-03-03 | | | |
| | | IronZero | [] | win.ironzero | [] | 2026-03-03 | | | |
| | | RMS | ['Gussdoor', 'Remote Manipulator System', 'RuRAT'] | win.rms | ['TA505'] | 2026-03-03 | | | |
| | | GONEPOSTAL | ['Cordyceps', 'NOTDOOR'] | win.gonepostal | ['APT28'] | 2026-03-03 | | | |
| | | InsidiousGh0st | [] | osx.insidiousgh0st | ['Unfading Sea Haze'] | 2026-02-26 | | | |
| | | InsidiousGh0st | [] | elf.insidiousgh0st | ['Unfading Sea Haze'] | 2026-02-26 | | | |
| | | ArcaneStealer | [] | win.arcane_stealer | [] | 2026-03-03 | | | |
| | | BlackByte | [] | win.blackbyte | [] | 2026-03-02 | | | |
| | | FudModule | ['LIGHTSHOW'] | win.fudmodule | ['Lazarus Group'] | 2026-03-02 | | | |
| | | Nokoyawa Ransomware | [] | win.nokoyawa | [] | 2026-03-02 | | | |
| | | BADAUDIO | [] | win.badaudio | ['APT24'] | 2026-03-02 | | | |
| | | SUGARLOADER | [] | osx.sugarloader | ['Lazarus Group'] | 2026-02-27 | | | |
| | | ComeBacker | [] | win.comebacker | ['Lazarus Group'] | 2026-02-27 | | | |
| | | Medusa | [] | win.medusa | [] | 2026-02-27 | | | |
| | | GRIMBOLT | [] | elf.grimbolt | [] | 2026-02-27 | | | |
| | | SLAYSTYLE | [] | jar.slaystyle | [] | 2026-02-27 | | | |
| | | BRICKSTORM | [] | elf.brickstorm | ['UTA0178'] | 2026-02-27 | | | |
| | | Agent Tesla | ['AgenTesla', 'AgentTesla', 'Negasteal'] | win.agent_tesla | ['SWEED'] | 2026-02-27 | | | |
| | | KarstoRAT | [] | win.karsto_rat | [] | 2026-02-26 | | | |
| | | Broomstick | ['CLEANBOOST', 'CleanUp', 'CleanUpLoader', 'Oyster'] | win.broomstick | [] | 2026-02-25 | | | |
| | | Airstalk | [] | win.airstalk | ['CL-STA-1009'] | 2026-02-25 | | | |
| | | DRAT | [] | win.drat | ['TAG-140'] | 2026-02-25 | | | |
| | | Ashen | ['AshTag'] | win.ashen | ['WIRTE'] | 2026-02-25 | | | |
| | | PortStarter | ['SocksProxyGo'] | win.portstarter | ['Vanilla Tempest'] | 2026-02-25 | | | |
| | | WalkLoader | [] | elf.walkloader | [] | 2026-02-25 | | | |
| | | GoldenSpy | [] | win.goldenspy | [] | 2026-02-25 | | | |
| | | GoldenHelper | [] | win.goldenhelper | [] | 2026-02-25 | | | |
| | | LockerGoga | [] | win.lockergoga | ['FIN6'] | 2026-02-25 | | | |
| | | Ryuk | [] | win.ryuk | ['FIN6', 'GRIM SPIDER', 'UNC1878', 'WIZARD SPIDER'] | 2026-02-25 | | | |
| | | FriedEx | ['BitPaymer', 'DoppelPaymer', 'IEncrypt'] | win.friedex | ['INDRIK SPIDER'] | 2026-02-25 | | | |
| | | Clop | ['Cl0p'] | elf.clop | [] | 2026-02-25 | | | |
| | | Mespinoza | ['pysa'] | win.mespinoza | [] | 2026-02-25 | | | |
| | | Egregor | [] | win.egregor | [] | 2026-02-25 | | | |