H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BBSRAT](https://attack.mitre.org/software/S0127) is malware with remote access tool functionality that has been used in targeted compromises. (Citation: Palo Alto Networks BBSRAT)

Labels

malware

14 recorded

Relationships

uses

to Archive via Library

Technique

uses

to Component Object Model Hijacking

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Process Discovery

Technique

uses

to Process Hollowing

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Service Execution

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Service Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

2 external

References

mitre-attack

S0127

open

Palo Alto Networks BBSRAT

http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/

open