rat
ShadowRAT
Named by 1 report, 5 detection rules, 0 IOC feeds and 1 tracked actor.
Also written as: Shadow RAT. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Shadow RAT & XWorm Open Directory Campaign
RAT_ShadowRAT_v2640_Client, RAT_ShadowRAT_CommonDLL, RAT_ShadowRAT_AMSI_ETW_Bypass, RAT_ShadowRAT_Crypto_Clipper, RAT_ShadowRAT_WinRE_Persistence
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-003: Commodity MaaS consumer running Shadow RAT and XWorm from one Windows VPS
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.