Loading malware…
Brute Ratel C4 is a commercial post-exploitation command-and-control framework created for red-team operations that has been repeatedly abused by threat actors, including ransomware operators and espionage-focused intruders. It is commonly used as an alternative to Cobalt Strike and deploys implants known as badgers that provide covert remote access to compromised systems. Observed malicious use includes execution of attacker commands, establishment of stealthy command-and-control channels, persistence, lateral movement, payload delivery, and support for follow-on ransomware activity. The framework has also been noted for defensive-evasion features such as detection of EDR userland hooks, and some intrusion chains have loaded it in memory or into legitimate processes to reduce visibility.
Brute Ratel C4 has appeared in multiple intrusion ecosystems rather than a single actor set. It has been observed in campaigns associated with Black Basta operations, in intrusions where QBot or Latrodectus delivered it as a follow-on payload, and in reporting linked to Nobelium and Patchwork-adjacent tradecraft discussions as part of broader attacker adoption of commercial or public offensive tooling. It has also been reported in activity thought to be connected to APT29-related operations, though attribution in some individual cases remains less certain than the malware identification itself.
Delivery and execution have varied by campaign. Document-themed phishing and spearphishing lures have been used to distribute archives or disk images that ultimately side-load Brute Ratel through benign applications. Observed chains include malicious ISO or IMG containers, Windows shortcut-based launchers, script-driven loaders, and DLL search order hijacking or side-loading using legitimate executables. Brute Ratel has also been deployed after exploitation of enterprise software vulnerabilities and by other malware families acting as loaders. In several cases, operators used private loaders or commodity malware to install Brute Ratel after initial access was established.
The framework primarily targets Windows environments in observed malicious use. Once active, it is used for post-compromise operations including persistence, remote command execution, lateral movement, and exfiltration support. Its role in real-world intrusions is best characterized as a stealth-oriented post-exploitation framework and backdoor capability that bridges initial access to hands-on-keyboard operations, credential and network abuse, and eventual monetization such as ransomware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-31324 možno zneužiť na nahratie súborov, vzdialené vykonanie kódu a získanie úplnej kontroly nad systémom. Zraniteľnosť je v súčasnosti aktívne zneužívaná útočníkmi na prienik do zraniteľných systémov. | Výskumníci z ReliaQuest zaznamenali šírenie frameworku BRUTE RATEL slúžiaceho na zabezpečenie perzistentného prístupu k systému...
The infection occurred within hours after the mass exploitation of webshells deployed on compromised NetWeaver instances started and involved the use of the Brute Ratel C2 framework.
... a subsequent attack involved the deployment of the Brute Ratel C2 framework using inline MSBuild task execution.
31 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently, our Unit 42 incident response team was engaged in a Black Basta breach response that uncovered several tools and malware samples on the victim's machines, including GootLoader malware, Brute Ratel C4 red-teaming tool and an older PlugX malware sample.
Threat actors spread malicious ISOs... The in-memory code, Brute Ratel C4, starts to communicate with IP 174.129.157[.]251 on TCP port 443... The threat actors can remotely access the infected device once the Brute Ratel has been loaded in order to run commands and spread farther throughout the compromised network.
References https://medium.com/@knownsec404team/the-patchwork-group-has-updated-its-arsenal-launching-attacks-for-the-first-time-using-brute-ratel-175741987d87
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
In late September 2022, Microsoft observed DEV-0506 adding Brute Ratel as a tool to facilitate their hands-on-keyboard access as well as Cobalt Strike Beacons.
40 distinct techniques documented for this family, organized by ATT&CK tactic.
The shellcode-based loader is stored onboard and is loaded into memory. The shellcode stager uses a few Anti Debugging checks such as checking the NtGlobalFlag.
Upon clicking Roshan-Bandara_CV_Dialog, cmd[.]exe is launched: /c start OneDriveUpdater[.]exe
The malicious version.dll file has an embedded unencrypted shellcode in its .data section that will be copied to an allocated memory address space with the PAGE_EXECUTE_READ protection to then be executed using the callback function of the EnumChildWindows Windows API.
When the victim mounts the ISO and executes the onedrive_fotos.exe binary, it will load the maliciously crafted version.dll.
This privilege token is abused by adversaries to elevate process access to inject malicious code or dump processes. | Process Injection (QAPC, CreateRemoteThread, and CreateSection Techniques)
Process Injection (QAPC, CreateRemoteThread, and CreateSection Techniques)
The simulated code will look for a cmd.exe process and inject shellcode that will execute a calc.exe.
Figure 11 shows the code function that duplicates the token of “winlogon.exe” or “logonui.exe” and uses that token to a new process using CreateProcessWithTokenW API.
During our analysis we found obfuscations based on scraping, PEB parsing and API hashing on stage 2, 3 and 4.
we have discovered a recent sample of Brute Ratel C4 packed with Themida.
To resolve the pointers of the functions, the program parses the PEB structure and then makes a loop in the name pointer table in IMAGE_EXPORT_DIRECTORY structure. A call on the hashing function is operated for each name in the table to find the correct function for the requested hash.
This privilege token is abused by adversaries to elevate process access to inject malicious code or dump processes. | Process Injection (QAPC, CreateRemoteThread, and CreateSection Techniques)
Process Injection (QAPC, CreateRemoteThread, and CreateSection Techniques)
The simulated code will look for a cmd.exe process and inject shellcode that will execute a calc.exe.
Another interesting feature of the BRC4 DLL agent is that it can evade Event Tracing for Windows (ETW) and AMSI Windows mechanisms by patching known API responsible for generating or tracing system events. Figure 12 shows the code of this DLL agent that patches “EtwEventWrite” API with “0xC3” opcode.
Figure 11 shows the code function that duplicates the token of “winlogon.exe” or “logonui.exe” and uses that token to a new process using CreateProcessWithTokenW API.
Figure 11 shows the code function that duplicates the token of “winlogon.exe” or “logonui.exe” and uses that token to a new process using CreateProcessWithTokenW API.
BRC4 is also capable of spoofing the parent process (PPID) for its newly created process to evade detections that are based on parent/child process relationships.
The encoded onboard DLL is still stored RC4 encrypted... As we previously mentioned, the RC4 key for the config is no longer the hardcoded value in the DLL. Instead, it is now the last 8 bytes from the decoded DLL blob.
APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.
Figure 14 shows the code snippet of the function that enumerates Address Resolution Protocol (ARP) entries or physical address map table for IPV4 on the local system using the GetIpNetTable Windows API.
Check the active and idle session of the user in the target host
The encoded onboard DLL is still stored RC4 encrypted... the RC4 key for the config is no longer the hardcoded value in the DLL. Instead, it is now the last 8 bytes from the decoded DLL blob.
The current version of Brute Ratel allows users to create command-and-control channels using legitimate tools such as Microsoft Teams, Slack and Discord. | Brute Ratel (BRc4) is a Command and Control (C2) framework designed to help attackers evade defence systems and remain undetected while executing malicious commands.
175 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
118 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named only in a reference link related to process injection behavior; no direct discussion of the malware/tool itself in the content.
Referenced as a follow-on payload delivered by Latrodectus after initial compromise.
Associated Analytic Story ... Remcos Trickbot Brute Ratel C4 RedLine Stealer PlugX MoonPeak WhisperGate
A native x64 Brute Ratel C4 binary used here as a delivery and evasion layer rather than a standalone C2 implant. It decrypts an embedded payload and injects PureHVNC stage 2 into notepad.exe using Early Bird APC queue injection, PPID spoofing to explorer.exe, direct syscalls, and process mitigation policies to block non-Microsoft DLL injection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.