S1028 Action RAT

malwareEnterprise

platformsWindows

also known asAction RAT

Action RAT is a remote access tool written in Delphi that has been used by SideCopy since at least December 2021 against Indian and Afghani government personnel.

techniques used (12)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1016System Network Configuration Discovery
T1027Obfuscated Files or Information
T1033System Owner/User Discovery
T1047Windows Management Instrumentation
T1059.003Windows Command Shell
T1071.001Web Protocols
T1082System Information Discovery
T1083File and Directory Discovery
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1518.001Security Software Discovery

used by groups (1)

Threat groups associated with this.

G1008SideCopy

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan