venomrat

VenomRAT: Multi-Stage Phishing, Cloud C2, and Modular Malware in Financial and IT Sector Attacks

Wes

03 Jun 2025 — 18 min read

I thought snakes ate mice? Does the snake even see him... I mean, it's right there! ... maybe the rat has an EDR?????

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Get questions like this:

what do you know about VenomRAT ?
What are the most effective detection and response strategies for organizations targeted by VenomRAT, especially in the financial sector?
How do VenomRAT’s evasion techniques evolve, and what new detection methods are emerging?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

Suggested Pivot

How are the latest multi-stage obfuscation and delivery techniques used in VenomRAT campaigns, such as VHD file execution and obfuscated batch scripts, evolving to evade detection, and what specific detection rule enhancements can be developed for EDR and email security solutions to counter these methods effectively?

Importance: VenomRAT’s use of sophisticated multi-stage payloads and obfuscation complicates detection, requiring continuous adaptation of security tools.
Next Steps: Conduct a technical workshop with detection engineers and threat hunters to analyze recent samples and update detection signatures and behavioral analytics.

TL;DR

Key Points

- VenomRAT, a Quasar RAT fork, is widely deployed via sophisticated phishing campaigns and fake antivirus sites, targeting U.S. financial and IT sectors.
- Prioritize user awareness training and advanced email security to disrupt initial access vectors.
- Attackers leverage multi-stage payloads (e.g., VHD files with obfuscated scripts) and cloud-hosted C2 (Amazon S3, Pastebin) for stealth and persistence.
- Deploy and tune EDR solutions for behavioral detection, and monitor for cloud-based C2 indicators.
- VenomRAT is often bundled with StormKitty (infostealer) and SilentTrinity (post-exploitation), enabling credential theft, data exfiltration, and long-term access.
- Integrate detection and response playbooks for multi-malware scenarios.
- The malware employs advanced evasion (AMSI/ETW bypass, sandbox evasion, dynamic API resolution) and is sold as a service, complicating attribution.
- Update detection rules for anti-analysis techniques and collaborate with threat intelligence providers.
- No major public breaches solely attributed to VenomRAT, but recent campaigns have resulted in widespread credential and crypto wallet theft.
- Establish incident response plans for rapid containment and credential reset.

Executive Summary

VenomRAT, first observed in 2020 as a fork of Quasar RAT, has evolved into a modular, service-based remote access trojan with advanced keylogging, stealth, and evasion capabilities. It is distributed primarily through phishing campaigns and fake antivirus websites (notably Bitdefender clones), with a focus on the U.S., Latin America, and Spain. Attackers use multi-stage payloads—such as ZIP archives containing VHD files with obfuscated batch scripts—to evade detection and facilitate data exfiltration.

VenomRAT campaigns frequently bundle additional malware, including StormKitty (for credential and crypto wallet theft) and SilentTrinity (for post-exploitation and persistence). The malware’s C2 infrastructure leverages cloud platforms like Amazon S3 and Pastebin, blending malicious traffic with legitimate cloud usage to evade network monitoring. Obfuscation tools such as ScrubCrypt and BatCloak are used to further complicate detection.

The primary motivation is financial gain, achieved through credential theft, data exfiltration, and resale of access. VenomRAT’s modularity and availability as a service on criminal forums enable widespread adoption and multi-stage, multi-malware operations. TA558 is the primary group linked to large-scale campaigns, but the service model allows for broad actor participation.

Key MITRE ATT&CK techniques include phishing (T1566), keylogging (T1056.001), AMSI/ETW bypass (T1562.001/006), application layer C2 (T1071), and sandbox evasion (T1497.001). While no major breaches are solely attributed to VenomRAT, recent campaigns have resulted in significant credential and data theft, especially via fake antivirus sites.

Recommended mitigations include targeted user awareness training, deployment and tuning of advanced EDR solutions (e.g., Rapid7 InsightIDR, VMware Carbon Black), enhanced email security with sandboxing, continuous network monitoring for cloud-based C2, and robust incident response planning. Organizations should also prioritize detection rule updates for VenomRAT’s evolving anti-analysis techniques and collaborate with threat intelligence providers to stay ahead of emerging TTPs.

Short-term forecasts anticipate continued refinement of multi-stage phishing, increased use of cloud C2, and further integration with complementary malware. Long-term, expect evolution toward polymorphic and cloud-native architectures, expansion into new sectors, and regulatory pressure for improved phishing defenses and endpoint security.

Research & Attribution

Origin

VenomRAT is a remote access trojan (RAT) first identified in June 2020. It is a modified fork of the open-source Quasar RAT, enhanced with additional capabilities such as advanced keylogging, stealth, and evasion techniques. The malware is widely distributed through phishing campaigns and fake websites impersonating legitimate software vendors, notably a fake Bitdefender antivirus download site. VenomRAT is often bundled with other open-source malware tools like SilentTrinity (for stealthy persistence) and StormKitty (an infostealer targeting credentials and crypto wallets). The malware is sold as a service on criminal forums, complicating attribution to specific threat actors.

Motivation

The primary motivation of threat actors deploying VenomRAT is financial gain. This is achieved through credential theft (including banking and crypto wallet credentials), data exfiltration, and maintaining persistent access to compromised systems for further exploitation or resale of access. The modular nature of VenomRAT and its associated tools allows attackers to conduct multi-stage operations focused on maximizing data theft and maintaining stealth.

Historical Context

VenomRAT emerged in mid-2020 as a fork of Quasar RAT and has since evolved with enhanced evasion and persistence features. It has been involved in multiple phishing campaigns globally, including significant activity in Latin America, Spain, and the United States. Recent campaigns have used sophisticated delivery methods such as fake antivirus websites, phishing emails with purchase order lures, and virtual hard disk (VHD) files containing obfuscated batch scripts for data exfiltration. The malware's evolution includes the integration of advanced anti-analysis techniques, AMSI and ETW bypasses, and dynamic API resolution to evade detection.

Timeline

June 2020: VenomRAT first observed as a Quasar RAT fork.
2022-2023: Adoption of obfuscation tools like ScrubCrypt and BatCloak; multi-stage attacks increase.
Early 2024: Large-scale phishing campaigns in Latin America and the U.S.
March 2025: Campaigns using VHD files for data exfiltration reported.
May 2025: Fake Bitdefender site campaigns targeting U.S. users continue.

Countries Targeted

United States – Extensive targeting via phishing campaigns using fake antivirus sites and credential theft.
Latin America (e.g., Mexico) – Large-scale phishing campaigns.
Spain – Targeted in phishing campaigns.
Canada – Indirect targeting through spoofed banking sites.
Other countries – Likely targeted due to malware availability on criminal forums.

Sectors Targeted

Financial Sector – Credential theft aimed at banking and crypto wallets.
IT Services – Phishing lures impersonate IT service providers.
General Enterprise – Broad phishing campaigns with purchase order attachments.
Cybersecurity Vendors – Fake antivirus software sites used for malware distribution.
Public Sector – Some government-related entities targeted.

Links to Other Malware

VenomRAT campaigns often include:

StormKitty (infostealer for passwords and crypto wallets)
SilentTrinity (post-exploitation framework for stealthy access)
ScrubCrypt and BatCloak (obfuscation and multi-stage deployment tools)

Similar Malware

Quasar RAT (original open-source base)
AsyncRAT (similar RAT with overlapping features)
XWorm (used in multi-malware campaigns)
DcRAT (shares some code with VenomRAT)

Threat Actors

TA558: Known for massive phishing campaigns deploying VenomRAT in Latin America and the U.S.
Other cybercriminal groups using fake antivirus sites and phishing lures.
Actors leveraging multi-stage attacks with obfuscation tools like ScrubCrypt and BatCloak.

MITRE ATT&CK Techniques (examples relevant to VenomRAT campaigns)

T1566: Phishing
T1056.001: Keylogging
T1071: Application Layer Protocol (C2 communication)
T1562.001: Impair Defenses (AMSI Bypass)
T1562.006: Impair Defenses (ETW Bypass)
T1082: System Information Discovery
T1497.001: Virtualization/Sandbox Evasion
T1057: Process Discovery
T1562.009: Endpoint Denial of Service (Anti-process monitoring)
T1125: Video Capture (Webcam access)

Breaches Involving This Malware

While no major public breach disclosures explicitly attribute large-scale data breaches solely to VenomRAT, recent campaigns have resulted in widespread credential theft and data exfiltration incidents in the U.S. For example, phishing campaigns using fake Bitdefender sites have targeted thousands of victims, stealing 2FA codes and crypto wallet credentials. VenomRAT is often part of multi-malware campaigns contributing to breaches and persistent access.

Attack Vectors and Infrastructure

VenomRAT is primarily delivered via:

Phishing emails with malicious attachments (e.g., ZIP archives containing VHD files)
Fake antivirus websites mimicking legitimate vendors (e.g., Bitdefender)
Multi-stage attacks using obfuscation tools like ScrubCrypt and BatCloak
Command and control (C2) infrastructure hosted on cloud platforms such as Amazon S3 and Pastebin
Use of virtual hard disk (VHD) files containing obfuscated batch scripts for stealthy execution and data exfiltration

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps..

(Subscribers Only)

Recommendations, Actions and Next Steps

Enhance User Awareness and Phishing Training Programs
- Develop and deploy targeted user awareness training focused on recognizing phishing attempts, especially those involving fake antivirus software sites (e.g., fake Bitdefender) and IT service impersonations. Incorporate simulated phishing campaigns that replicate VenomRAT delivery methods, such as purchase order lures and fake software downloads.
- Expected impact: Reduces the risk of initial compromise by empowering users to identify and avoid phishing threats, directly mitigating the primary infection vectors exploited by VenomRAT.
- Implementation steps: Partner with cybersecurity training vendors to create tailored, scenario-based content; schedule quarterly training sessions and phishing simulations; use platforms like KnowBe4 or Cofense to deliver and track training effectiveness.
- Challenges: Maintaining user engagement and combating training fatigue; ensuring content remains current with evolving threat tactics.
- Metrics: Track phishing simulation click rates and report rates via training platform dashboards; monitor reduction in phishing-related incidents reported to the SOC; review quarterly to adjust training focus.
- Business impact: Reduces potential financial losses and reputational damage by preventing credential theft and data breaches.
- MITRE ATT&CK IDs: T1566 (Phishing)
Deploy and Optimize Advanced Endpoint Detection and Response (EDR) Solutions with Specific Behavioral Indicators
- Implement or enhance EDR tools capable of detecting multi-stage, obfuscated malware behaviors and RAT-specific activities such as keylogging, stealth persistence, API hooking, and dynamic API resolution. Incorporate detection rules and YARA signatures targeting VenomRAT’s known behaviors, including AMSI and ETW bypass techniques.
- Expected impact: Enables early detection and rapid response to VenomRAT infections, limiting data exfiltration and persistent attacker presence.
- Implementation steps: Conduct a gap analysis of current endpoint security; deploy or upgrade to EDR solutions like Rapid7 InsightIDR or VMware Carbon Black; import and customize detection rules from trusted threat intelligence sources (e.g., MITRE ATT&CK, vendor threat feeds); train SOC analysts on identifying VenomRAT-specific alerts.
- Challenges: Integration complexity with existing infrastructure; tuning to reduce false positives; resource allocation for continuous monitoring.
- Metrics: Monitor number of VenomRAT-related detections and blocked executions via EDR dashboards; measure mean time to detect (MTTD) and mean time to respond (MTTR); review monthly with SOC and leadership.
- Business impact: Minimizes operational disruption and data loss by reducing dwell time of attackers.
- MITRE ATT&CK IDs: T1056.001 (Keylogging), T1562.001 (AMSI Bypass), T1562.006 (ETW Bypass), T1082 (System Information Discovery)
Strengthen Email Security Controls with Advanced Attachment and URL Filtering
- Deploy or enhance email security gateways with sandboxing and detonation capabilities to detect and block malicious attachments (e.g., ZIP archives containing VHD files) and URLs leading to fake antivirus websites. Integrate real-time threat intelligence feeds to update detection rules dynamically.
- Expected impact: Prevents initial malware delivery, significantly reducing infection rates from phishing campaigns.
- Implementation steps: Evaluate current email security posture; implement solutions such as Microsoft Defender for Office 365 or Proofpoint with advanced sandboxing; configure policies to quarantine or block suspicious attachments and URLs; conduct periodic policy reviews.
- Challenges: Balancing security with user productivity; managing false positives that may disrupt legitimate communications.
- Metrics: Number of malicious emails blocked or quarantined; reduction in user-reported phishing emails; monthly reporting to security leadership.
- Business impact: Protects organizational assets by reducing exposure to malware delivery vectors.
- MITRE ATT&CK IDs: T1566 (Phishing)
Monitor Network Traffic for VenomRAT Command and Control (C2) Indicators with Specific IoCs
- Establish continuous network monitoring for known VenomRAT C2 infrastructure, including domains and IPs hosted on cloud platforms such as Amazon S3 and Pastebin. Use network detection tools to identify anomalous application layer protocol usage consistent with VenomRAT’s C2 communications.
- Expected impact: Facilitates early detection of active infections and lateral movement, enabling rapid containment and mitigation.
- Implementation steps: Integrate updated threat intelligence feeds containing VenomRAT IoCs into SIEM and network monitoring tools; create and tune alerting rules for suspicious cloud storage access patterns and unusual DNS queries; conduct regular network traffic analysis and threat hunting exercises.
- Challenges: High volume of legitimate cloud traffic may generate noise; requires skilled analysts to investigate alerts effectively.
- Metrics: Number of detected C2 communications and blocked connections; time from detection to containment; quarterly review of network security posture.
- Business impact: Reduces risk of data exfiltration and persistent attacker presence.
- MITRE ATT&CK IDs: T1071 (Application Layer Protocol), T1497.001 (Virtualization/Sandbox Evasion)
Establish and Regularly Update Incident Response Plans Specific to RAT Infections
- Develop detailed incident response playbooks addressing VenomRAT infection scenarios, including containment, eradication, and recovery steps. Incorporate procedures for credential resets, forensic analysis, and communication protocols.
- Expected impact: Enhances organizational resilience by reducing attacker dwell time and minimizing operational impact.
- Implementation steps: Collaborate with incident response and SOC teams to draft and validate playbooks; conduct biannual tabletop exercises simulating VenomRAT incidents; update plans based on lessons learned and evolving threat landscape.
- Challenges: Ensuring plans remain current with evolving TTPs; coordinating cross-functional teams during incidents.
- Metrics: Incident response time metrics (MTTD, MTTR); success rate of containment and eradication; post-incident review findings.
- Business impact: Limits financial and reputational damage by enabling swift and effective response.
- MITRE ATT&CK IDs: T1562 (Impair Defenses), T1078 (Valid Accounts)

Suggested Pivots

How are the latest multi-stage obfuscation and delivery techniques used in VenomRAT campaigns, such as VHD file execution and obfuscated batch scripts, evolving to evade detection, and what specific detection rule enhancements can be developed for EDR and email security solutions to counter these methods effectively?
- Importance: VenomRAT’s use of sophisticated multi-stage payloads and obfuscation complicates detection, requiring continuous adaptation of security tools.
- Next Steps: Conduct a technical workshop with detection engineers and threat hunters to analyze recent samples and update detection signatures and behavioral analytics.
What are the operational challenges and mitigation strategies related to VenomRAT’s use of cloud platforms (Amazon S3, Pastebin, Bitbucket) for hosting C2 infrastructure and payloads, and how can network monitoring and threat intelligence integration be optimized to detect and disrupt these cloud-based operations?
- Importance: Cloud-hosted C2 infrastructure blends with legitimate traffic, making detection and takedown more difficult.
- Next Steps: Review current network monitoring capabilities, integrate updated IoCs for cloud services, and develop anomaly detection rules focused on cloud storage access patterns.
What are the most effective user awareness and phishing simulation strategies to counter VenomRAT’s prevalent social engineering tactics, including fake antivirus websites (e.g., Bitdefender spoofing) and purchase order phishing lures, especially considering the use of social engineering techniques like ClickFix?
- Importance: User interaction remains the primary infection vector; tailored training can significantly reduce successful compromises.
- Next Steps: Design targeted phishing simulations replicating VenomRAT delivery methods and evaluate user response metrics to refine training content.
How do VenomRAT campaigns coordinate with other malware families such as StormKitty and SilentTrinity in multi-malware operations, particularly in initial access, credential theft, and persistence phases, and what implications does this have for incident response prioritization and threat hunting?
- Importance: Understanding the interplay between malware components can improve detection and containment strategies.
- Next Steps: Map attack chains and develop integrated detection and response playbooks addressing multi-malware scenarios.
Which specific static indicators of compromise (IoCs) and behavioral signatures unique to VenomRAT infections—such as API hooking patterns, AMSI/ETW bypass techniques, and command execution behaviors—can be prioritized for inclusion in endpoint detection rules to improve early detection while minimizing false positives?
- Importance: Precise IoCs and behavioral analytics are critical for timely detection and reducing alert fatigue.
- Next Steps: Collaborate with EDR vendors and threat intelligence providers to validate and deploy refined detection signatures.

Forecast

Short-Term Forecast (3-6 months)

Continued Refinement and Expansion of Multi-Stage Phishing Campaigns Delivering VenomRAT
- VenomRAT operators will persist in deploying sophisticated phishing campaigns using fake antivirus websites (notably Bitdefender clones) and purchase order lures. These campaigns will increasingly utilize multi-stage payloads such as VHD files with obfuscated batch scripts to evade detection and maintain stealth, primarily targeting U.S. financial and IT sectors.
- Examples:
  - May 2025 campaigns distributing VenomRAT via fake Bitdefender sites.
  - March 2025 use of VHD files for stealthy execution and data exfiltration.
- What to watch out for:
  - Spike in phishing emails with ZIP attachments containing VHD files.
  - Emergence of new fake antivirus or IT service impersonation websites.
  - Detection of obfuscated batch scripts or unusual VHD file activity.
- Reasoning: The intelligence product documents ongoing campaigns with these tactics, and the modular nature of VenomRAT facilitates continuous adaptation.
Increased Use of Cloud Platforms for Command and Control Infrastructure
- Attackers will further exploit cloud services such as Amazon S3 and Pastebin to host VenomRAT C2 infrastructure and payloads, blending malicious traffic with legitimate cloud usage to evade network detection and takedown efforts.
- Examples:
  - Current campaigns leveraging Amazon S3 and Pastebin for C2.
  - Similar RAT families increasingly using cloud services for resilient C2.
- What to watch out for:
  - Anomalous access patterns to cloud storage services.
  - New IoCs related to cloud-hosted domains or IPs linked to VenomRAT.
- Reasoning: Cloud-based C2 offers operational advantages, and the intelligence product confirms its use, indicating this trend will continue.
Continued Integration of VenomRAT with Complementary Malware in Multi-Malware Campaigns
- VenomRAT will remain a key component in multi-malware campaigns alongside StormKitty (infostealer) and SilentTrinity (post-exploitation framework), enabling attackers to maximize credential theft, persistence, and stealth.
- Examples:
  - Documented campaigns bundling VenomRAT with StormKitty and SilentTrinity.
  - Multi-malware campaigns targeting Latin America and the U.S.
- What to watch out for:
  - Detection of combined malware signatures or behaviors in endpoint telemetry.
  - Incident reports indicating multi-stage infections involving multiple malware families.
- Reasoning: The modular and service-based nature of VenomRAT facilitates its use in complex attack chains.
Heightened Targeting of Financial Credentials and Cryptocurrency Wallets
- Threat actors will intensify efforts to steal banking credentials and crypto wallet information using VenomRAT’s keylogging and infostealer capabilities, capitalizing on the growing value and adoption of digital assets.
- Examples:
  - Campaigns stealing 2FA codes and crypto wallet credentials via fake antivirus sites.
  - Use of StormKitty to harvest sensitive financial data.
- What to watch out for:
  - Increase in credential theft reports linked to phishing campaigns.
  - Targeting of cryptocurrency exchanges and wallet providers.
- Reasoning: Financial gain remains the primary motivation, and the intelligence product documents active targeting of these assets.
Accelerated Deployment and Tuning of Advanced Endpoint Detection and Response (EDR) Solutions
- Organizations, especially in financial and IT sectors, will prioritize deploying and optimizing EDR solutions capable of detecting VenomRAT’s multi-stage, obfuscated behaviors, including AMSI and ETW bypass techniques.
- Examples:
  - Recommendations to deploy Rapid7 InsightIDR and VMware Carbon Black.
  - Industry trends toward behavioral detection of stealthy malware.
- What to watch out for:
  - Improved detection rates of VenomRAT infections.
  - Vendor updates releasing new detection signatures for VenomRAT.
- Reasoning: The sophistication of VenomRAT’s evasion techniques necessitates advanced detection capabilities.

Long-Term Forecast (12-24 months)

Evolution of VenomRAT and Associated Malware with Enhanced Evasion Techniques Grounded in Recent Malware Trends
- VenomRAT and its associated malware (StormKitty, SilentTrinity) will evolve to incorporate more advanced evasion methods such as polymorphic code and enhanced sandbox evasion, similar to trends observed in malware families like Emotet and TrickBot, which have adopted polymorphism and modular architectures to evade detection.
- Examples:
  - Emotet’s evolution to polymorphic loaders and modular payloads.
  - TrickBot’s use of advanced sandbox evasion and modular updates.
- What to watch out for:
  - Emergence of VenomRAT variants with polymorphic or AI-assisted obfuscation.
  - Increased use of sandbox evasion techniques beyond AMSI and ETW bypass.
- Reasoning: Malware evolution follows a pattern of adopting proven evasion techniques; VenomRAT is likely to follow similar trajectories.
Expansion of VenomRAT Targeting to New Geographies and Critical Sectors
- VenomRAT campaigns will broaden to include additional countries and sectors such as healthcare and critical infrastructure, mirroring historical expansion patterns of RAT families like AsyncRAT and XWorm, as attackers seek higher-value targets with potentially weaker defenses.
- Examples:
  - AsyncRAT’s expansion from initial targets to broader sectors.
  - XWorm’s targeting of critical infrastructure in recent years.
- What to watch out for:
  - Reports of VenomRAT infections in healthcare or infrastructure sectors.
  - Phishing lures tailored to new industries or regions.
- Reasoning: Financially motivated actors adapt targeting to maximize returns and exploit emerging opportunities.
Adoption of Cloud-Native and Containerized Architectures for C2 Infrastructure
- Building on current cloud-based C2 usage, attackers will increasingly leverage cloud-native technologies such as serverless functions and container orchestration platforms (e.g., AWS Lambda, Kubernetes) to host C2 infrastructure, as seen in recent campaigns by advanced threat groups like APT29 and FIN7.
- Examples:
  - APT29’s use of cloud services and serverless functions for stealthy C2.
  - FIN7’s adoption of containerized malware delivery mechanisms.
- What to watch out for:
  - Detection of serverless or container-based C2 infrastructure linked to VenomRAT.
  - New IoCs involving cloud-native service abuse.
- Reasoning: Cloud-native architectures provide scalability and stealth, attractive for long-term operations.
Development of Integrated Detection and Response Frameworks for Multi-Malware Campaigns
- Security vendors and organizations will develop integrated detection and response frameworks that correlate behaviors across multiple malware families (VenomRAT, StormKitty, SilentTrinity) to improve incident response and threat hunting, following industry trends toward unified threat management platforms.
- Examples:
  - Emergence of platforms like Microsoft Defender XDR and CrowdStrike Falcon Fusion.
  - Case studies showing improved response to multi-malware incidents.
- What to watch out for:
  - Release of integrated detection tools or playbooks addressing multi-malware.
  - Increased collaboration between threat intelligence providers and EDR vendors.
- Reasoning: Coordinated attacks require coordinated defenses; integrated frameworks will become essential.
Regulatory and Industry Pressure to Strengthen Phishing Defenses and Cyber Hygiene
- Regulatory bodies and industry groups will increase mandates and best practices focused on phishing prevention, user training, and endpoint security, driven by persistent RAT threats and their financial impact, similar to recent regulatory pushes in the financial sector (e.g., FFIEC guidance updates).
- Examples:
  - FFIEC’s enhanced cybersecurity guidance for financial institutions.
  - EU’s NIS2 Directive emphasizing phishing and endpoint security.
- What to watch out for:
  - Publication of new cybersecurity regulations or guidelines.
  - Increased adoption of phishing-resistant authentication methods.
- Reasoning: Persistent phishing threats and financial losses will drive regulatory and organizational responses.

MITRE ATT&CK IDs

T1566, T1056.001, T1562.001, T1562.006, T1071, T1497.001, T1082, T1057, T1562.009, T1125, T1048, TA0001, TA0005, TA0011, S0154

Appendix

References

(2025-05-29) - Fake Bitdefender website used to spread infostealer malware
(2025-05-27) - Cybercriminals Clone Antivirus Site to Spread Venom RAT and Steal Crypto Wallets
(2025-03-18) - VenomRat malware campaign uses VHD files for data exfiltration
(2024-11-21) - A Bag of RATs: VenomRAT vs. AsyncRAT
(2025-05-27) - Inside a VenomRAT Malware Campaign – DomainTools Investigations
(2025-03-13) - Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware – Microsoft Security Blog

AlphaHunt