H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cobian RAT](https://attack.mitre.org/software/S0338) is a backdoor, remote access tool that has been observed since 2016.(Citation: Zscaler Cobian Aug 2017)

Labels

malware

8 recorded

Relationships

uses

to Audio Capture

Technique

uses

to DNS

Technique

uses

to Keylogging

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Standard Encoding

Technique

uses

to Video Capture

Technique

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

S0338

open

Cobian RAT

—

Zscaler Cobian Aug 2017

https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat

open