rat
CloudSync
A custom C++ RAT with a Tor-reachable panel, found with the .NET SvchostPayload RAT on the same assembler toolkit. Named by 1 report, 5 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: CloudSync RAT. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
CloudSync: An Assembler's Intrusion Toolkit
RAT_CloudSync_TorPanel_NetscanBuild, RAT_CloudSync_C2Protocol_DualBuild, Loader_ABExe_DeploymentOrchestrator_Banners, Loader_CtBat_ProxyAwareUSBWormStub, RAT_CloudSync_PublicWorkdir_Artifacts
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-021: Assembler-model intrusion operator staging other actors' tooling against one German victim forest
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.