H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Rifdoor](https://attack.mitre.org/software/S0433) is a remote access trojan (RAT) that shares numerous code similarities with [HotCroissant](https://attack.mitre.org/software/S0431).(Citation: Carbon Black HotCroissant April 2020)

Labels

malware

10 recorded

Relationships

uses

from Andariel

Group

uses

to Binary Padding

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Malicious File

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Spearphishing Attachment

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

2 external

References

mitre-attack

S0433

open

Carbon Black HotCroissant April 2020

https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/

open