Loading threat actor…
NyashTeam is a Russian-speaking malware-as-a-service operator active since at least 2022 that markets and supports commodity malware for cybercriminal customers. The group is closely associated with the WebRAT brand and has been linked to the sale and operation of WebRAT/SalatStealer as well as DCRat (DarkCrystal RAT). Its business model includes reseller-style branding, customer support, and sales conducted through Telegram-based channels, indicating a service-oriented criminal ecosystem rather than a single closed intrusion set. NyashTeam’s flagship tooling combines remote-access trojan and infostealer functionality. WebRAT/SalatStealer has been observed targeting browser credentials, cookies, authentication tokens, cryptocurrency wallets, messaging applications, gaming platforms, and other locally stored secrets. Reported capabilities include keylogging, screen capture, webcam and microphone capture, remote shell access, file download, process control, SOCKS5 proxying, clipboard monitoring, persistence, self-deletion, and hidden-desktop interaction. The malware has also been described as using privilege-escalation and credential-access techniques including COM elevation abuse, token theft, LSASS targeting, and Microsoft Defender exclusion abuse. Operationally, NyashTeam has used resilient command-and-control approaches intended to complicate disruption and detection, including encrypted runtime configuration, DNS-over-HTTPS, WebSocket over TLS, QUIC/HTTP3 for exfiltration, and in some reporting TON DNS-based resolution for rotating command-and-control endpoints. Delivery has been associated with fake proof-of-concept repositories and weaponized Telegram distribution. Persistence mechanisms reported for its malware include Registry Run keys and scheduled tasks. The actor is assessed as originating from Russia or operating from Russian infrastructure, with reporting linking its operations to Russian-speaking operators and infrastructure in Russian cities. NyashTeam has been the subject of infrastructure disruption efforts, including takedowns affecting a large number of associated domains, but reporting indicates the group rebuilt infrastructure and continued operations afterward. Known aliases and associated branding include WebRAT. NyashTeam is best characterized as a financially motivated cybercrime service provider enabling credential theft, surveillance, and post-compromise access for customers and affiliates.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
39 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-speaking malware-as-a-service group operating and distributing SalatStealer/WebRAT, selling access since approximately 2022, rebuilding infrastructure after prior disruption, and using TON blockchain DNS for resilient C2. The group also distributes DCRat and has used fake CVE PoC GitHub repositories and Telegram channels for delivery.
Operating a malware-as-a-service platform tied to SalatStealer, with reseller infrastructure, affiliate routing, Cloudflare-fronted exfiltration domains, Beget-hosted backends, and Telegram-based sales/support.
NyashTeam is a cybercriminal group selling WebRAT and DCRat, malware used for remote access, data theft, and spyware functions, often distributed via fake PoC exploits.
NyashTeam is a Russian-speaking cybercriminal group offering Salat Stealer (aka WEB_RAT or WebRAT) as malware-as-a-service, targeting browser credentials and cryptocurrency wallets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.