H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[NavRAT](https://attack.mitre.org/software/S0247) is a remote access tool designed to upload, download, and execute files. It has been observed in attacks targeting South Korea. (Citation: Talos NavRAT May 2018)

Labels

malware

10 recorded

Relationships

uses

from APT37

Group

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to Local Data Staging

Technique

uses

to Mail Protocols

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to System Information Discovery

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0247

open

NavRAT

—

Talos NavRAT May 2018

https://blog.talosintelligence.com/2018/05/navrat.html

open