H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Revenge RAT](https://attack.mitre.org/software/S0379) is a freely available remote access tool written in .NET (C#).(Citation: Cylance Shaheen Nov 2018)(Citation: Cofense RevengeRAT Feb 2019)

Labels

malware

20 recorded

Relationships

uses

to Audio Capture

Technique

uses

to Bidirectional Communication

Technique

uses

to Indirect Command Execution

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Keylogging

Technique

uses

to Mshta

Technique

uses

to OS Credential Dumping

Technique

uses

to PowerShell

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Video Capture

Technique

uses

to Windows Command Shell

Technique

uses

to Winlogon Helper DLL

Technique

uses

from TA2541

Group

uses

from The White Company

Group

3 external

References

mitre-attack

S0379

open

Cofense RevengeRAT Feb 2019

https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/

open

Cylance Shaheen Nov 2018

https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517

open