Threat intelligence / Malware

ComRAT

[ComRAT](https://attack.mitre.org/software/S0126) is a second stage implant suspected of being a descendant of [Agent.btz](https://attack.mitre.org/software/S0092) and used by [Turla](https://attack.mitre.org/groups/G0010). The first version of [ComRAT](https://attack.mitre.org/software/S0126) was identified in 2007, but the tool has undergone substantial development for many years since.(Citation: Symantec Waterbug)(Citation: NorthSec 2015 GData Uroburos Tools)(Citation: ESET ComRAT May 2020)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ComRAT](https://attack.mitre.org/software/S0126) is a second stage implant suspected of being a descendant of [Agent.btz](https://attack.mitre.org/software/S0092) and used by [Turla](https://attack.mitre.org/groups/G0010). The first version of [ComRAT](https://attack.mitre.org/software/S0126) was identified in 2007, but the tool has undergone substantial development for many years since.(Citation: Symantec Waterbug)(Citation: NorthSec 2015 GData Uroburos Tools)(Citation: ESET ComRAT May 2020)

Labels

malware

23 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Bidirectional Communication

Technique

uses

to Command Obfuscation

Technique

uses

to Component Object Model Hijacking

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Embedded Payloads

Technique

uses

to Fileless Storage

Technique

uses

to Hidden File System

Technique

uses

to Mail Protocols

Technique

uses

to Masquerade Task or Service

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to Scheduled Transfer

Technique

uses

to Software Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from Turla

Group

4 external

References

mitre-attack

S0126

ESET ComRAT May 2020

https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf

NorthSec 2015 GData Uroburos Tools

https://docplayer.net/101655589-Tools-used-by-the-uroburos-actors.html

Symantec Waterbug

https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1