| | | shadowhammer | ['DAYJOB'] | win.shadowhammer | ['Operation ShadowHammer'] | 2021-09-19 | | | |
| | | Shadow RAT | [] | win.shadow_rat | [] | 2025-11-13 | | | |
| | | ShadyHammock | [] | win.shady_hammock | [] | 2025-11-25 | | | |
| | | Shakti | [] | win.shakti | [] | 2017-02-15 | | | |
| | | SHAPESHIFT | [] | win.shapeshift | ['APT33'] | 2017-09-29 | | | |
| | | shareip | ['remotecmd'] | win.shareip | ['UPS'] | 2018-04-17 | | | |
| | | SHARPKNOT | ['Bitrep'] | win.sharpknot | ['Silent Chollima'] | 2018-04-13 | | | |
| | | SHATTEREDGLASS | ['Unidentified 081'] | win.shatteredglass | ['Silent Chollima'] | 2024-08-01 | | | |
| | | Shifu | [] | win.shifu | [] | 2022-02-14 | | | |
| | | Shim RAT | [] | win.shimrat | ['Mofang'] | 2020-05-23 | | | |
| | | SHIPSHAPE | [] | win.shipshape | ['APT 30'] | 2022-08-25 | | | |
| | | ShortLeash | [] | win.shortleash | [] | 2025-06-24 | | | |
| | | ShrinkLocker | [] | win.shrinklocker | [] | 2025-02-25 | | | |
| | | Shujin | [] | win.shujin | [] | 2018-02-21 | | | |
| | | Shylock | ['Caphaw'] | win.shylock | [] | 2023-05-23 | | | |
| | | SideTwist | [] | win.sidetwist | ['OilRig'] | 2023-09-07 | | | |
| | | SideWalk | ['ScrambleCross'] | win.sidewalk | [] | 2024-09-02 | | | |
| | | SideWinder | [] | win.sidewinder | ['RAZOR TIGER', 'SloppyLemming'] | 2025-02-10 | | | |
| | | SiennaPurple | ['HolyLocker', 'H0lyGh0st'] | win.sienna_purple | [] | 2026-09-24 | | | |
| | | Sierra(Alfa,Bravo, ...) | ['Destover'] | win.sierras | ['Lazarus Group'] | 2024-11-29 | | | |
| | | PureLocker | [] | win.purelocker | [] | 2019-11-20 | | | |
| | | PurpleFox | [] | win.purplefox | [] | 2024-02-02 | | | |
| | | PurpleWave | [] | win.purplewave | [] | 2022-11-15 | | | |
| | | Pushdo | [] | win.pushdo | [] | 2021-02-25 | | | |
| | | Putabmow | [] | win.putabmow | [] | 2018-07-24 | | | |
| | | puzzlemaker | [] | win.puzzlemaker | ['[Unnamed group]'] | 2021-07-20 | | | |
| | | PvzOut | [] | win.pvzout | ['Cleaver'] | 2017-05-21 | | | |
| | | PwndLocker | ['ProLock'] | win.pwndlocker | [] | 2022-01-25 | | | |
| | | pwnpos | [] | win.pwnpos | [] | 2020-10-05 | | | |
| | | Pykspa | [] | win.pykspa | [] | 2025-09-12 | | | |
| | | Qaccel | [] | win.qaccel | [] | 2018-07-24 | | | |
| | | Qadars | [] | win.qadars | [] | 2022-05-05 | | | |
| | | QHost | ['Tolouge'] | win.qhost | [] | 2024-09-11 | | | |
| | | QtBot | ['qtproject'] | win.qtbot | [] | 2017-11-07 | | | |
| | | QuantLoader | [] | win.quantloader | ['Guru Spider'] | 2022-02-14 | | | |
| | | QuanPinLoader | [] | win.quan_pin_loader | ['Lazarus Group'] | 2025-11-21 | | | |
| | | QUARTERRIG | ['MUSKYBEAT', 'STATICNOISE'] | win.quarterrig | ['APT29'] | 2023-10-18 | | | |
| | | QuickHeal | [] | win.quickheal | [] | 2024-12-16 | | | |
| | | QUICKMUTE | [] | win.quickmute | ['Tonto Team'] | 2022-07-13 | | | |
| | | QuirkyLoader | [] | win.quirkyloader | [] | 2025-08-22 | | | |
| | | QuiteRAT | ['Acres'] | win.quiterat | ['Silent Chollima'] | 2023-08-28 | | | |
| | | r77 | ['r77 Rootkit'] | win.r77 | [] | 2025-03-21 | | | |
| | | r980 | [] | win.r980 | [] | 2017-02-15 | | | |
| | | Raccoon | ['Mohazo', 'RaccoonStealer', 'Racealer', 'Racoon'] | win.raccoon | [] | 2025-05-19 | | | |
| | | Racket Downloader | [] | win.racket | ['Lazarus Group'] | 2023-12-11 | | | |
| | | Rad | [] | win.rad | [] | 2021-10-24 | | | |
| | | Radamant | [] | win.radamant | [] | 2017-02-15 | | | |
| | | RadRAT | [] | win.radrat | [] | 2018-04-23 | | | |
| | | RagnarLocker | [] | win.ragnarlocker | [] | 2024-03-18 | | | |
| | | Ragnarok | [] | win.ragnarok | [] | 2024-11-29 | | | |
| | | RAILSETTER | [] | win.railsetter | [] | 2025-11-13 | | | |
| | | RALord | [] | win.ralord | [] | 2025-12-15 | | | |
| | | Rambo | ['brebsd'] | win.rambo | ['DragonOK'] | 2022-09-19 | | | |
| | | Ramdo | [] | win.ramdo | [] | 2016-04-20 | | | |
| | | Ramnit | ['Nimnul'] | win.ramnit | [] | 2026-05-18 | | | |
| | | Ramsay | [] | win.ramsay | ['DarkHotel'] | 2022-12-01 | | | |
| | | Ranbyus | [] | win.ranbyus | [] | 2024-02-13 | | | |
| | | Ransoc | [] | win.ransoc | [] | 2016-12-28 | | | |
| | | RansomEXX | ['Ransom X', 'Defray777'] | win.ransomexx | ['GOLD DUPONT'] | 2025-04-25 | | | |
| | | RansomHub | [] | win.ransomhub | ['RansomHub'] | 2026-01-26 | | | |
| | | Ransomlock | ['WinLock'] | win.ransomlock | [] | 2018-01-02 | | | |
| | | Rapid Ransom | [] | win.rapid_ransom | [] | 2022-11-15 | | | |
| | | Rarog | [] | win.rarog | [] | 2019-01-06 | | | |
| | | rarstar | [] | win.rarstar | ['Tick'] | 2022-11-15 | | | |
| | | Ratankba | ['QUICKRIDE'] | win.ratankba | ['Lazarus Group'] | 2023-08-13 | | | |
| | | RatankbaPOS | ['RATANKBAPOS'] | win.ratankbapos | ['Lazarus Group'] | 2023-08-14 | | | |
| | | RATel | [] | win.ratel | [] | 2023-08-25 | | | |
| | | Raven Stealer | [] | win.ravenstealer | [] | 2025-09-17 | | | |
| | | RAWDOOR | [] | win.rawdoor | ['APT31'] | 2025-02-28 | | | |
| | | RawPOS | [] | win.rawpos | [] | 2020-04-17 | | | |
| | | Razr ransomware | [] | win.razr | [] | 2026-02-15 | | | |
| | | RC2FM | [] | win.rc2fm | [] | 2022-08-25 | | | |
| | | RCS | ['Remote Control System', 'Crisis'] | win.rcs | ['Hacking Team', 'APT-C-34'] | 2024-11-25 | | | |
| | | RCtrl | [] | win.rctrl | ['APT 30'] | 2020-06-20 | | | |
| | | RDAT | ['GREYSTUFF'] | win.rdat | ['OilRig'] | 2025-06-16 | | | |
| | | ReactorBot | [] | win.reactorbot | [] | 2017-06-07 | | | |
| | | Reaver | [] | win.reaver | [] | 2019-05-17 | | | |
| | | RedAlpha | [] | win.redalpha | [] | 2018-07-06 | | | |
| | | RedCurl | [] | win.redcurl | [] | 2026-07-01 | | | |
| | | RedLeaves | ['BUGJUICE'] | win.redleaves | ['Stone Panda'] | 2022-06-22 | | | |
| | | REDPEPPER | ['Adupib'] | win.redpepper | ['PLATINUM'] | 2020-01-01 | | | |
| | | REDSALT | ['Dipsind'] | win.redsalt | ['PLATINUM'] | 2020-01-20 | | | |
| | | REDSHAWL | [] | win.redshawl | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Redyms | [] | win.redyms | [] | 2018-10-18 | | | |
| | | Red Gambler | [] | win.red_gambler | [] | 2018-07-11 | | | |
| | | ReedBed | [] | win.reedbed | ['MALLARD SPIDER', 'UNC4393'] | 2025-03-28 | | | |
| | | Regin | [] | win.regin | [] | 2026-04-09 | | | |
| | | RegPhantom | [] | win.regphantom | [] | 2026-03-23 | | | |
| | | RegretLocker | [] | win.regretlocker | [] | 2023-05-25 | | | |
| | | win.rekoobe | ['tinyshell.win', 'tshd.win'] | win.rekoobew | ['FIN7'] | 2021-12-08 | | | |
| | | Rekt Loader | [] | win.rektloader | [] | 2020-07-15 | | | |
| | | RemCom | ['RemoteCommandExecution'] | win.remcom | [] | 2024-04-11 | | | |
| | | Remexi | ['CACHEMONEY'] | win.remexi | ['APT39', 'Chafer'] | 2023-05-25 | | | |
| | | RemotePE | [] | win.remotepe | ['Lazarus Group'] | 2026-06-09 | | | |
| | | Remsec | [] | win.remsec_strider | ['ProjectSauron'] | 2020-04-21 | | | |
| | | Remy | ['WINDSHIELD'] | win.remy | [] | 2020-05-23 | | | |
| | | Rerdom | [] | win.rerdom | [] | 2018-08-10 | | | |
| | | Resident | [] | win.resident | ['TA866'] | 2024-11-11 | | | |
| | | Retefe | ['Tsukuba', 'Werdlod'] | win.retefe | [] | 2019-05-23 | | | |
| | | Retro | [] | win.retro | ['DarkHotel'] | 2021-12-17 | | | |