H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[RDAT](https://attack.mitre.org/software/S0495) is a backdoor used by the suspected Iranian threat group [OilRig](https://attack.mitre.org/groups/G0049). [RDAT](https://attack.mitre.org/software/S0495) was originally identified in 2017 and targeted companies in the telecommunications sector.(Citation: Unit42 RDAT July 2020)

Labels

malware

21 recorded

Relationships

uses

Group

uses

to Data Obfuscation

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Fallback Channels

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Mail Protocols

Technique

uses

to Masquerade Task or Service

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Non-Standard Encoding

Technique

uses

to Screen Capture

Technique

uses

to Standard Encoding

Technique

uses

to Steganography

Technique

uses

to Steganography

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0495

Unit42 RDAT July 2020

https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/