Loading story…
Researchers documented WebMonitor, a commodity remote access trojan sold on underground forums by an actor known as Revcode, as part of a broader shift toward RAT-as-a-Service offerings that bundle malware with hosted command-and-control infrastructure. Instead of requiring buyers to stand up their own servers, WebMonitor provided browser-based administration panels and customer-specific virtual hosts under domains including revcode[.]eu and later wm01[.]to, lowering the barrier to entry for less-skilled operators. Palo Alto Networks said the malware had been marketed since 2017 and was linked to more than 2,000 infection attempts observed against customers across multiple industries worldwide.
The malware was described as being written in Visual Basic 6, packed with UPX, installed in the victim's AppData\Roaming directory, and configured for persistence through HKCU Run registry keys. Researchers also noted suspicious DNS behavior in later samples and a one-off connection to a Monero mining pool, suggesting the author may have been testing additional capabilities. Separate reporting on Quaverse RAT similarly highlighted the emergence of remote-access malware sold with service-based infrastructure, underscoring how hosted C2 panels and subscription-style support are turning commodity RAT operations into easier-to-deploy criminal services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
A Krebs on Security report cited Swedish business and tax records indicating that RevCode, the company behind WebMonitor, was owned by Alex Yücel, who had pleaded guilty in 2015 to creating and selling the Blackshades RAT. RevCode denied any connection to Blackshades and claimed the listed owner was not the same person.
Palo Alto Networks publicly documented WebMonitor as a previously undocumented commodity RAT with hosted C2 infrastructure, reporting more than 2,000 infection attempts and over 500 distinct samples observed.
Samples first observed in late November 2017 began performing DNS lookups for multiple non-existent domains in the form <username>.<8_char_hex_value>.to, indicating a change in behavior whose purpose was unclear.
A second root command-and-control domain, wm01[.]to, was brought online in late July 2017, expanding WebMonitor's centralized C2-as-a-service infrastructure beyond revcode[.]eu.
An actor using the name "Revcode" advertised WebMonitor on HackForums in May 2017, offering the malware as a commodity RAT with hosted web-based command-and-control.
The report says apparent testing activity for the WebMonitor RAT was first observed in late February 2017, marking the earliest known activity tied to the malware.
The report states WebMonitor had been on the market since at least mid-2017, sold in multiple editions for prices ranging from €14.99 to €29.99.
In January, a partner identified as "Softpatch" offered an Android RAT client related to WebMonitor and posted source code on GitHub.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
krebsonsecurity.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourcetrustwave.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026
Researchers have identified **QuimaRAT**, a Java-based remote access trojan sold through a **malware-as-a-service (MaaS)** model and built to infect **Windows, Linux, and macOS** systems. The malware is part of a broader Quima toolkit that includes **Quima Builder**, **Quima Loader**, and **Quima Dropper**, enabling operators to generate payloads in formats such as JAR, EXE, APP, SH, BAT, and VBS, stage delivery through browser-cache techniques, and deploy HTML or SVG droppers. Reported pricing ranges from **$150 per month** to **$1,200 for lifetime access**, indicating an effort to lower the barrier for affiliates and other threat actors. QuimaRAT uses a modular architecture with encrypted plugins and flexible command-and-control over **TCP, WebSocket, TLS, and HTTPS**, with dynamic C2 rotation reportedly supported through Pastebin-based updates. Analysis found persistence mechanisms tailored to each operating system, along with sandbox evasion, single-instance enforcement, optional decoy execution via a Binder function, and Windows fileless shellcode execution. Once deployed, the RAT can remotely execute commands, steal credentials, transfer files, manipulate the clipboard, conduct webcam surveillance, and expand functionality on demand through additional plugins.
Jul 7, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026