H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

CARROTBAT

[CARROTBAT](https://attack.mitre.org/software/S0462) is a customized dropper that has been in use since at least 2017. [CARROTBAT](https://attack.mitre.org/software/S0462) has been used to install [SYSCON](https://attack.mitre.org/software/S0464) and has infrastructure overlap with [KONNI](https://attack.mitre.org/software/S0356).(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[CARROTBAT](https://attack.mitre.org/software/S0462) is a customized dropper that has been in use since at least 2017. [CARROTBAT](https://attack.mitre.org/software/S0462) has been used to install [SYSCON](https://attack.mitre.org/software/S0464) and has infrastructure overlap with [KONNI](https://attack.mitre.org/software/S0356).(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)

Labels

malware
6 recorded

Relationships

uses
to Command Obfuscation
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to System Information Discovery
Technique
uses
to Windows Command Shell
Technique
3 external

References

mitre-attack
S0462
open
Unit 42 CARROTBAT November 2018
https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/
open
Unit 42 CARROTBAT January 2020
https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance