Threat intelligence / Malware

RATANKBA

[RATANKBA](https://attack.mitre.org/software/S0241) is a remote controller tool used by [Lazarus Group](https://attack.mitre.org/groups/G0032). [RATANKBA](https://attack.mitre.org/software/S0241) has been used in attacks targeting financial institutions in Poland, Mexico, Uruguay, the United Kingdom, and Chile. It was also seen used against organizations related to telecommunications, management consulting, information technology, insurance, aviation, and education. [RATANKBA](https://attack.mitre.org/software/S0241) has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines. (Citation: Lazarus RATANKBA) (Citation: RATANKBA)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

16 recorded

Relationships

uses

from Lazarus Group

Group

uses

to Dynamic-link Library Injection

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Remote System Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

S0241

open

RATANKBA

https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html

open

Lazarus RATANKBA

https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/

open