Malware

MoDi RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The attack chain started with a malicious email message that contained some hostile VB scripting code... The attack begins when a recipient of the malspam opens the message attachment.

Execution

5 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1059Command and Scripting InterpreterEvidence1

which included a Scheduled Task that started a Visual Basic Script file that, in turn, launches PowerShell

T1059.001PowerShellEvidence1

The VBS code launches PowerShell and then runs this code, which takes data from the VBS and inserts it into the system’s clipboard, where it can then programmatically “paste” the commands into the PowerShell window using the VBS SendKeys command.

T1059.005Visual BasicEvidence1

The attack chain started with a malicious email message that contained some hostile VB scripting code... The initial VBScript writes out a second VBS file to the filesystem

T1204.002Malicious FileEvidence1

The attack begins when a recipient of the malspam opens the message attachment.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1112Modify RegistryEvidence1

The initial VBScript writes out a second VBS file to the filesystem, and inserts three new entries into the Windows Registry that contain binary data... PowerShell extracts a .NET decoder executable from one of the Registry blobs

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1055Process InjectionEvidence1

reflectively loads it by injecting it into a system process... Then the injector loads the payload (injecting into the host application, msbuild.exe).

Stealth

2 techniques

T1055Process InjectionEvidence1

reflectively loads it by injecting it into a system process... Then the injector loads the payload (injecting into the host application, msbuild.exe).

T1620Reflective Code LoadingEvidence1

PowerShell extracts a .NET decoder executable from one of the Registry blobs... and reflectively loads it by injecting it into a system process.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Collection

2 techniques

T1115Clipboard DataEvidence1

the VBS code launches PowerShell and then runs this code, which takes data from the VBS and inserts it into the system’s clipboard, where it can then programmatically “paste” the commands into the PowerShell window

T1560Archive Collected DataEvidence1

lead to a .Zip archive, hosted in OneDrive cloud storage, that contains an encoded VBS (VBE) file.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The Visual Basic Script in the message attachment connects to a remote site, which is the entry point into a series of HTTP 302 redirects that eventually lead to a .Zip archive, hosted in OneDrive cloud storage, that contains an encoded VBS (VBE) file.

T1219Remote Access ToolsEvidence1

concluded by delivering a commodity remote access Trojan named MoDi RAT.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

Email-delivered MoDi RAT attack pastes PowerShell commands | SOPHOS

A commodity remote access trojan delivered through a malspam-initiated, multi-stage fileless attack chain using VBScript, PowerShell, registry-stored payload components, reflective loading, and process injection into msbuild.exe.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MoDi RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The attack chain started with a malicious email message that contained some hostile VB scripting code... The attack begins when a recipient of the malspam opens the message attachment.

Execution

5 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1059Command and Scripting InterpreterEvidence1

which included a Scheduled Task that started a Visual Basic Script file that, in turn, launches PowerShell

T1059.001PowerShellEvidence1

T1059.005Visual BasicEvidence1

The attack chain started with a malicious email message that contained some hostile VB scripting code... The initial VBScript writes out a second VBS file to the filesystem

T1204.002Malicious FileEvidence1

The attack begins when a recipient of the malspam opens the message attachment.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1112Modify RegistryEvidence1

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

It then launches a system utility to create a new Scheduled Task that, at a predetermined time in the future, launches the VBS script.

T1055Process InjectionEvidence1

reflectively loads it by injecting it into a system process... Then the injector loads the payload (injecting into the host application, msbuild.exe).

Stealth

2 techniques

T1055Process InjectionEvidence1

reflectively loads it by injecting it into a system process... Then the injector loads the payload (injecting into the host application, msbuild.exe).

T1620Reflective Code LoadingEvidence1

PowerShell extracts a .NET decoder executable from one of the Registry blobs... and reflectively loads it by injecting it into a system process.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Collection

2 techniques

T1115Clipboard DataEvidence1

T1560Archive Collected DataEvidence1

lead to a .Zip archive, hosted in OneDrive cloud storage, that contains an encoded VBS (VBE) file.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

T1219Remote Access ToolsEvidence1

concluded by delivering a commodity remote access Trojan named MoDi RAT.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

sophos threat researchNews

Jan 1, 2026

Email-delivered MoDi RAT attack pastes PowerShell commands | SOPHOS

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.