Loading malware…
Ares RAT is a Python-based remote access tool associated with South Asian cyber-espionage activity, particularly operations linked to Transparent Tribe (APT36), and has also appeared in reporting on activity connected to SideCopy-aligned ecosystems. It has been used against Indian government, defense, and government-aligned organizations as part of long-term intelligence-collection campaigns.
Observed deployments include Linux-focused intrusion chains in which a Go-based downloader or stager installs Ares RAT and establishes persistence through systemd user services, allowing the malware to survive reboots while blending into normal user-level service activity. Once active, Ares RAT has been observed performing automated system profiling, recursive file enumeration, command execution, and structured data exfiltration. Reporting also describes it as capable of executing Python scripts or operator-issued commands to harvest sensitive information from compromised hosts.
The malware is typically delivered through spearphishing-led campaigns using weaponized documents, malicious attachments, or linked download stages tailored to Indian government and defense themes. Its operational role is consistent with stealthy post-compromise access, host reconnaissance, collection of sensitive files, and ongoing surveillance rather than disruptive effects. Ares RAT forms part of a broader cross-platform tooling set used by these espionage actors as they expand beyond Windows-centric tradecraft into Linux environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its arsenal includes Ares RAT, Action RAT, AllaKore RAT, Reverse RAT, Margulas RAT and more.
"Running parallel to this Windows-focused campaign is a Linux variant... to drop a Python-based Ares RAT..."
"Prior campaigns ... have leveraged malware families like Ares RAT..."
9 distinct techniques documented for this family, organized by ATT&CK tactic.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan previously leveraged in prior campaigns (no additional capabilities described in this content).
Remote access trojan used in campaigns targeting Indian defense sector and government-aligned organizations; used to steal sensitive data and maintain access.
Python-based RAT deployed on Linux via a Go dropper and shell script. Supports a wide range of commands to harvest sensitive data and execute Python scripts/commands issued by the operator.
Python-based remote access trojan used on Linux; performs host profiling and structured data exfiltration, and persists via systemd user services to survive reboots while blending into normal operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.