H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CrossRAT](https://attack.mitre.org/software/S0235) is a cross platform RAT.

Labels

malware

6 recorded

Relationships

uses

to File and Directory Discovery

Technique

uses

to Launch Agent

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to XDG Autostart Entries

Technique

uses

from Dark Caracal

Group

3 external

References

mitre-attack

S0235

CrossRAT

—

Lookout Dark Caracal Jan 2018

https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf