H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ObliqueRAT](https://attack.mitre.org/software/S0644) is a remote access trojan, similar to [Crimson](https://attack.mitre.org/software/S0115), that has been in use by [Transparent Tribe](https://attack.mitre.org/groups/G0134) since at least 2020.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)

Labels

malware

15 recorded

Relationships

uses

to Data from Removable Media

Technique

uses

to Data Transfer Size Limits

Technique

uses

to File and Directory Discovery

Technique

uses

to Local Data Staging

Technique

uses

to Malicious Link

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Steganography

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Video Capture

Technique

uses

from Transparent Tribe

Group

3 external

References

mitre-attack

S0644

Talos Oblique RAT March 2021

https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html

Talos Transparent Tribe May 2021

https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html