{
  "family": "revenge",
  "sample_count": 41,
  "category": "trojan",
  "description": "Backdoor:Win32/Revenge (or Revenge RAT) is a highly capable, commercially available Remote Access Trojan (RAT). Written in .NET, it is widely utilized by both script kiddies and Advanced Persistent Threat (APT) groups due to its ease of use, extensive plugin architecture, and robust control panel.<br><br><b>Understanding Revenge RAT</b><br>To the victim, a Revenge RAT infection is completely invisible. For threat intelligence analysts, encountering Revenge RAT indicates a significant breach. Because the source code has been leaked and modified extensively on underground forums, attribution is extremely difficult. The RAT provides the attacker with absolute, interactive control over the compromised endpoint, functioning as a full surveillance and post-exploitation platform.<br><br><b>Execution and Evasion Strategies</b><br>Revenge RAT is typically distributed via spearphishing campaigns containing weaponized Office documents, malicious links, or disguised executables. Upon execution, it often utilizes standard 'crypters' or packers to evade static AV detection. It drops its core executable into the `%AppData%` directory and establishes persistence via the Registry Run keys or Startup folder. Revenge RAT boasts a massive feature set: it can log keystrokes (`T1056.001`), capture webcam and microphone feeds (`T1125`), steal saved browser credentials, interact with the command prompt, and download/execute secondary payloads. It communicates with its C2 server using a custom, often encrypted, TCP protocol.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise, massive data exfiltration, and severe privacy violations. EDR platforms are highly effective at detecting the behavioral anomalies of Revenge RAT, such as anomalous keylogging, unauthorized webcam access, or the spawning of `cmd.exe` by an unknown process. Network logs will reveal continuous, beaconing traffic to the attacker's C2 server. Memory forensics is crucial to extract the decrypted RAT configuration, which contains the specific C2 IP address/domain and the attacker's preferred port.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1056.001",
    "T1125",
    "T1059.003",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video/Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session and halt data exfiltration.",
    "Capture a full forensic memory image of the machine to extract the decrypted Revenge RAT payload and its C2 configuration.",
    "Assume all locally saved passwords and typed data have been compromised; perform a clean OS rebuild and force global password resets.",
    "Review network firewall logs to identify the C2 IP address and block it enterprise-wide to prevent further beaconing."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the attacker may have already dropped secondary backdoors or established alternative persistence."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}