Loading threat actor…
Rogue Raticate, also referred to as RATicate, is a cybercrime threat actor associated with phishing-driven malware delivery operations that culminate in deployment of NetSupport RAT. Reported activity includes email phishing campaigns using PDF decoys to entice user interaction and the use of a Traffic Distribution System to route victims through the infection chain before malware delivery. The actor has also been linked by naming convention and structural similarity to fake browser update activity involving compromised websites, browser-specific lures, Internet shortcut files, obfuscated HTA launchers, and PowerShell-based payload retrieval that ultimately installs NetSupport RAT. Observed tradecraft indicates emphasis on social engineering, staged delivery, and defense evasion through obfuscated scripting and intermediary delivery infrastructure. Based on the available information, Rogue Raticate is best characterized as a financially motivated cybercrime actor focused on initial access and malware deployment rather than a nation-state espionage group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercrime group attributed to an email phishing campaign using PDF decoys and a TDS to deliver NetSupport RAT.
Named activity cluster/campaign involving fake-update lures delivered via URL shortcuts, using compromised WordPress sites and WebDAV-hosted payload staging to ultimately load NetSupport RAT.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.