| | | Termite | [] | win.termite | [] | 2022-06-27 | | | |
| | | TerraStealer | ['StealerOne', 'SONE', 'Taurus Loader Stealer Module'] | win.terra_stealer | ['VENOM SPIDER', 'FIN6'] | 2025-05-12 | | | |
| | | TeslaCrypt | ['cryptesla'] | win.teslacrypt | [] | 2023-06-09 | | | |
| | | Tetra Loader | [] | win.tetra_loader | [] | 2025-05-26 | | | |
| | | TFlower | [] | win.tflower | [] | 2021-03-04 | | | |
| | | Thanatos | ['Alphabot'] | win.thanatos | [] | 2017-01-05 | | | |
| | | Thanatos Ransomware | [] | win.thanatos_ransom | [] | 2018-07-05 | | | |
| | | ThreeByte | [] | win.threebyte | ['IXESHE'] | 2017-05-21 | | | |
| | | ThumbThief | [] | win.thumbthief | [] | | | | |
| | | ThunderX | ['Ranzy Locker'] | win.thunderx | [] | 2022-01-24 | | | |
| | | Thunker | [] | win.thunker | [] | 2018-07-24 | | | |
| | | Tidepool | [] | win.tidepool | ['Mirage'] | 2023-01-25 | | | |
| | | TigerLite | [] | win.tigerlite | ['Silent Chollima'] | 2024-08-15 | | | |
| | | Tiger RAT | [] | win.tiger_rat | ['Silent Chollima'] | 2024-08-15 | | | |
| | | tildeb | [] | win.tildeb | ['Equation Group'] | 2021-09-19 | | | |
| | | Tinba | ['Zusy', 'TinyBanker', 'Illi'] | win.tinba | [] | 2022-06-09 | | | |
| | | TinyFluff | [] | win.tinyfluff | [] | 2023-07-12 | | | |
| | | TinyLoader | [] | win.tinyloader | ['Tiny Spider'] | 2020-07-24 | | | |
| | | TinyMet | ['TiniMet'] | win.tinymet | ['Anunak', 'TA505'] | 2023-08-03 | | | |
| | | TinyNuke | ['NukeBot', 'Nuclear Bot', 'MicroBankingTrojan', 'Xbot'] | win.tinynuke | [] | 2022-08-28 | | | |
| | | TinyTurlaNG | ['TTNG'] | win.tinyturla_ng | ['Turla'] | 2024-10-21 | | | |
| | | TinyTyphon | [] | win.tinytyphon | ['Dropping Elephant'] | 2020-04-06 | | | |
| | | TinyTurla | [] | win.tiny_turla | ['Turla'] | 2023-10-05 | | | |
| | | Tiop | [] | win.tiop | [] | 2018-07-24 | | | |
| | | Tmanger | ['LuckyBack'] | win.tmanger | ['TA428'] | 2024-10-15 | | | |
| | | Tofsee | ['Gheg'] | win.tofsee | [] | 2023-10-17 | | | |
| | | TokyoX | [] | win.tokyox | [] | 2022-01-18 | | | |
| | | TOLLBOOTH | ['HijackServer IIS'] | win.tollbooth | [] | 2025-10-22 | | | |
| | | TONEDEAF | [] | win.tonedeaf | ['APT34'] | 2021-04-10 | | | |
| | | TONERJAM | [] | win.tonerjam | [] | 2026-02-25 | | | |
| | | Topinambour | [] | win.topinambour | [] | 2023-04-26 | | | |
| | | Torisma | [] | win.torisma | ['Lazarus Group'] | 2024-11-29 | | | |
| | | TorrentLocker | ['Teerac'] | win.torrentlocker | [] | 2021-09-19 | | | |
| | | TorLoader | [] | win.tor_loader | [] | 2023-07-11 | | | |
| | | TOUCHMOVE | [] | win.touchmove | ['Lazarus Group'] | 2023-11-27 | | | |
| | | TOUGHPROGRESS | ['Calendarwalk'] | win.toughprogress | ['APT41'] | 2026-03-23 | | | |
| | | TransBox | [] | win.transbox | [] | 2023-02-17 | | | |
| | | TreasureHunter | ['huntpos'] | win.treasurehunter | [] | 2018-05-14 | | | |
| | | TrickBot | ['Trickster', 'TheTrick', 'TrickLoader'] | win.trickbot | ['TA505', 'UNC1878', 'WIZARD SPIDER'] | 2026-04-22 | | | |
| | | Trochilus RAT | [] | win.trochilus_rat | ['APT31', 'GALLIUM', 'Stone Panda'] | 2022-09-20 | | | |
| | | Troldesh | ['Shade'] | win.troldesh | [] | 2023-05-02 | | | |
| | | Troll Stealer | [] | win.troll_stealer | ['Kimsuky'] | 2024-02-09 | | | |
| | | Tropidoor | [] | win.tropidoor | ['WageMole'] | 2025-10-20 | | | |
| | | Tuoni | [] | win.tuoni | [] | 2024-05-14 | | | |
| | | turian | [] | win.turian | [] | 2023-06-09 | | | |
| | | TurlaRPC | [] | win.turla_rpc | ['Turla'] | 2022-12-01 | | | |
| | | Turla SilentMoon | ['BigBoss', 'Cacao', 'GoldenSky', 'HyperStack'] | win.turla_silentmoon | ['Turla'] | 2022-12-01 | | | |
| | | TURNEDUP | ['Notestuk'] | win.turnedup | ['APT33'] | 2020-08-21 | | | |
| | | Running RAT | ['running_rat'] | win.runningrat | [] | 2024-11-15 | | | |
| | | Rustock | [] | win.rustock | [] | 2022-02-14 | | | |
| | | Rustonotto | ['CHILLYCHINO'] | win.rustonotto | ['APT37'] | 2025-09-09 | | | |
| | | RustyRocket | [] | win.rustyrocket | [] | 2026-03-10 | | | |
| | | RustyClaw | [] | win.rusty_claw | ['RomCom'] | 2025-11-25 | | | |
| | | Ryuk | [] | win.ryuk | ['FIN6', 'GRIM SPIDER', 'UNC1878', 'WIZARD SPIDER'] | 2026-02-25 | | | |
| | | Ryuk Stealer | ['Sidoh'] | win.ryuk_stealer | [] | 2021-09-02 | | | |
| | | SADBRIDGE | [] | win.sadbridge | [] | 2025-01-02 | | | |
| | | SafeNet | [] | win.safenet | [] | 2020-01-22 | | | |
| | | Sagerunex | [] | win.sagerunex | ['LOTUS PANDA'] | 2026-01-05 | | | |
| | | SAGE | ['Saga'] | win.sage_ransom | [] | 2019-07-20 | | | |
| | | SaiGon | [] | win.saigon | [] | 2020-09-01 | | | |
| | | Saint Bot | [] | win.saint_bot | [] | 2022-07-25 | | | |
| | | Sakula RAT | ['Sakurel'] | win.sakula_rat | ['APT 26', 'Hurricane Panda'] | 2024-05-21 | | | |
| | | Salgorea | ['BadCake'] | win.salgorea | ['APT32'] | 2020-05-06 | | | |
| | | Sality | [] | win.sality | ['Salty Spider'] | 2023-11-14 | | | |
| | | Sanny | [] | win.sanny | [] | 2020-06-08 | | | |
| | | SantaStealer | [] | win.santa_stealer | [] | 2026-01-05 | | | |
| | | SappyCache | [] | win.sappycache | [] | 2020-07-15 | | | |
| | | Sarhust | ['ENDCMD', 'Hussarini'] | win.sarhust | [] | 2020-06-30 | | | |
| | | Sasfis | ['Oficla'] | win.sasfis | [] | 2018-11-28 | | | |
| | | Satan | ['5ss5c', 'DBGer', 'Lucky Ransomware'] | win.satan | [] | 2020-01-16 | | | |
| | | Satana | [] | win.satana | [] | 2023-06-09 | | | |
| | | Satellite Turla | [] | win.satellite_turla | ['Turla'] | 2022-11-17 | | | |
| | | Sathurbot | [] | win.sathurbot | [] | 2020-02-03 | | | |
| | | ScanLine | [] | win.scanline | ['Volt Typhoon'] | 2024-02-08 | | | |
| | | ScanPOS | [] | win.scanpos | [] | 2022-09-19 | | | |
| | | Scarabey | ['MVP', 'Scarab-Russian', 'Scarab'] | win.scarabey | [] | 2019-08-19 | | | |
| | | ScareCrow | [] | win.scarecrow | [] | 2022-12-19 | | | |
| | | Scavenger | ['scavenger', 'SCVNGR', 'scvngr'] | win.scavenger | [] | 2025-07-29 | | | |
| | | Scieron | [] | win.scieron | [] | 2022-09-20 | | | |
| | | ScoringMathTea | [] | win.scoring_math_tea | ['Lazarus Group'] | 2025-11-21 | | | |
| | | Scout | [] | win.scout | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Scranos | [] | win.scranos | [] | 2025-07-21 | | | |
| | | ScreenCap | [] | win.screencap | [] | 2022-10-24 | | | |
| | | SDBbot | [] | win.sdbbot | ['TA505'] | 2023-02-17 | | | |
| | | SeaSalt | [] | win.seasalt | ['Comment Crew'] | 2018-02-13 | | | |
| | | SecondHandTea | [] | win.secondhandtea | ['Lazarus Group'] | 2025-09-15 | | | |
| | | SeDll | [] | win.sedll | ['Leviathan'] | 2020-05-23 | | | |
| | | Sedreco | ['azzy', 'eviltoss'] | win.sedreco | ['APT28'] | 2022-05-04 | | | |
| | | Seduploader | ['jhuhugit', 'jkeyskw', 'downrage', 'carberplike', 'GAMEFISH'] | win.seduploader | ['APT28'] | 2024-07-10 | | | |
| | | SelfMake Loader | [] | win.selfmake | ['BlackTech'] | 2022-09-30 | | | |
| | | SendSafe | [] | win.sendsafe | [] | 2021-01-11 | | | |
| | | SepSys | ['Silvertor Ransomware'] | win.sepsys | [] | 2020-10-15 | | | |
| | | Sepulcher | [] | win.sepulcher | ['TA413'] | 2021-02-25 | | | |
| | | SessionManager | [] | win.session_manager | ['Gelsemium'] | 2022-07-05 | | | |
| | | Sfile | ['Morseop', 'Escal'] | win.sfile | [] | 2022-06-09 | | | |
| | | shadowhammer | ['DAYJOB'] | win.shadowhammer | ['Operation ShadowHammer'] | 2021-09-19 | | | |
| | | Shadow RAT | [] | win.shadow_rat | [] | 2025-11-13 | | | |
| | | ShadyHammock | [] | win.shady_hammock | [] | 2025-11-25 | | | |
| | | Shakti | [] | win.shakti | [] | 2017-02-15 | | | |
| | | SHAPESHIFT | [] | win.shapeshift | ['APT33'] | 2017-09-29 | | | |