Threat Library

Malware And Tools. What They Do.

The malware families and tools that show up again and again in attacks, what they do and how to spot them.

Malware.

AcidRain.

AcidRain is a wiper built as an ELF program for modems and routers that use MIPS processors.

Wiper.
Since 2022.
Network Devices, Linux.

Profile.

Malware.

Akira.

Akira is ransomware that locks files on a victim network and is used to demand payment.

Ransomware.
Windows.

Profile.

Malware.

Amadey Malware: How The Loader Works And How To Find It.

Amadey.

Amadey is a Windows loader that downloads and runs other malware on infected PCs, and criminals buy it as a service.

Loader.
Since 2018.
Windows.

Profile.

Malware.

ARTEX: The Open-Source AI Pentest Framework Attackers Use.

ARTEX.

ARTEX is an open-source, multi-agent AI penetration testing framework that can use any AI model.

Legitimate tool abused.

Profile.

Malware.

Bad Rabbit.

Win32/Diskcoder.D.

Bad Rabbit is self-propagating ransomware for Windows.

Ransomware.
Windows.

Profile.

Malware.

BARECLAW Tunneler.

BARECLAW is a tunneler written in C that Google Threat Intelligence Group says a suspected China-nexus espionage group ran on a BeyondTrust Remote Support appliance in 2026.

Profile.

Malware.

Black Basta.

Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying.

Ransomware.
Since 2022.
Windows, ESXi.

Profile.

Malware.

BlackCat.

ALPHV, Noberus.

BlackCat is ransomware written in Rust that was offered to criminal affiliates as a ransomware-as-a-service.

Ransomware.
Since 2021.
Linux, Windows.

Profile.

Malware.

BlackEnergy.

Black Energy.

BlackEnergy is a malware toolkit for Windows.

Framework.
Since 2007.
Windows.

Profile.

Malware.

BRICKSTORM Backdoor.

BRICKSTORM is a backdoor that hides on VMware vCenter servers, ESXi hosts and network appliances.

Remote access trojan.
Since 2024.

Profile.

Malware.

CaddyWiper.

CaddyWiper is destructive malware for Windows that overwrites files and drive structures.

Wiper.
Since 2022.
Windows.

Profile.

Malware.

Candiru Spyware.

Candiru spyware is surveillance software made by Candiru, an Israeli company that the Citizen Lab says sells spyware only to governments.

Windows.

Profile.

Malware.

CanisterWorm.

CanisterWorm is a self-propagating worm that steals cloud and developer credentials and uses stolen npm tokens to push itself into more software packages.

Infostealer.
Since 2026.
Containers, Linux.

Profile.

Malware.

China Chopper.

China Chopper is a small web shell that attackers place on a web server to get remote access to it.

Remote access trojan.
Windows.

Profile.

Malware.

Clop.

Clop is ransomware for Windows that locks files and adds its own file extension.

Ransomware.
Since 2019.
Windows.

Profile.

Malware.

Cobalt Strike.

Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks.

Legitimate tool abused.
Since 2012.
Linux, macOS, Windows.

Profile.

Malware.

Conti.

Conti is ransomware that steals a victim's files, encrypts Windows systems and then demands payment.

Ransomware.
Since 2019.
Windows.

Profile.

Malware.

Crimson RAT.

MSIL/Crimson.

Crimson RAT is a remote access trojan for Windows.

Remote access trojan.
Since 2016.
Windows.

Profile.

Malware.

CROSSROAD Downloader.

CROSSROAD is the name Google Threat Intelligence Group and Mandiant give to a downloader used in a 2026 tampering of AOMEI Backupper updates.

Loader.
Since 2026.
Windows.

Profile.

Malware.

Cyclops Blink.

Cyclops Blink is modular malware that runs on small office and home office network devices, mainly WatchGuard devices.

Botnet.
Since 2019.
Network Devices.

Profile.

Malware.

Derusbi.

PHOTO.

Derusbi is malware that MITRE ATT&CK says is used by multiple Chinese APT groups.

Remote access trojan.
Windows, Linux.

Profile.

Malware.

Dtrack.

Dtrack is spyware for Windows that MITRE ATT&CK says was discovered in 2019.

Remote access trojan.
Windows.

Profile.

Malware.

Emotet.

Geodo.

Emotet is a modular Windows malware that began as a banking Trojan and became a loader, a tool that installs other malware such as banking Trojans or ransomware.

Loader.
Since 2014.
Windows.

Profile.

Malware.

Evilginx.

evilginx2.

Evilginx is a free, open source toolkit that sits between a victim and a real website and copies what passes through, including passwords and login session cookies.

Legitimate tool abused.

Profile.

Malware.

FASTCash.

FASTCash is the name the US Government gives to an ATM cash-out scheme and the malware behind it.

Remote access trojan.
Since 2016.
AIX, Windows.

Profile.

Malware.

Gh0st RAT.

Mydoor, Moudoor.

gh0st RAT is a remote access tool for Windows and macOS.

Remote access trojan.
Windows, macOS.

Profile.

Malware.

GlassWorm Malware: From VS Code Extensions To The OVHcloud CLI Swap.

GlassWorm is a worm that targets developer tools.

Loader.
Since 2025.
macOS, Windows.

Profile.

Malware.

HOOKEDGE Backdoor.

HOOKEDGE is a lightweight Windows backdoor made of batch scripts, delivered through Word documents that carry a macro.

Remote access trojan.
Since 2025.
Windows.

Profile.

Malware.

HOPLIGHT.

HOPLIGHT is a backdoor Trojan for Windows.

Remote access trojan.
Windows.

Profile.

Malware.

Impacket.

Impacket is a free, open source set of Python modules for working with network protocols.

Legitimate tool abused.
Linux, macOS, Windows.

Profile.

Malware.

Industroyer.

CRASHOVERRIDE, Win32/Industroyer.

Industroyer, also called CrashOverride, is a malware framework built to disrupt industrial control systems, specifically parts used in electrical substations.

Framework.
Since 2016.
Windows.

Profile.

Malware.

Infamous Chisel.

Infamous Chisel is a collection of components that targets Android devices.

Remote access trojan.
Android.

Profile.

Malware.

Kazuar.

Kazuar is a backdoor Trojan that runs on Windows and macOS.

Remote access trojan.
Windows, macOS.

Profile.

Malware.

KV Botnet.

KV Botnet is malware that took over small office and home office routers and linked them into a botnet.

Botnet.

Profile.

Malware.

LAPLAS Implant.

LAPLAS is a Windows implant used by the group Silent Lynx.

Remote access trojan.
Windows.

Profile.

Malware.

Mimikatz.

Mimikatz is a tool that pulls Windows account logins and passwords out of a computer.

Legitimate tool abused.
Since 2007.
Windows.

Profile.

Malware.

Mini Shai-Hulud.

Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines.

Infostealer.
Since 2026.

Profile.

Malware.

NICECURL.

NICECURL is a backdoor written in VBScript.

Remote access trojan.
Windows.

Profile.

Malware.

NotPetya.

ExPetr, Diskcoder.C, GoldenEye.

NotPetya is destructive malware that looks like ransomware.

Wiper.
Since 2017.
Windows.

Profile.

Malware.

Olympic Destroyer.

Olympic Destroyer is a Windows wiper that was used against computers supporting the 2018 Winter Olympics in Pyeongchang, South Korea.

Wiper.
Since 2018.
Windows.

Profile.

Malware.

PEERSTITCH Malware.

PEERSTITCH is a small Linux program that Palo Alto Networks Unit 42 found on Fortinet FortiGate firewalls.

Loader.
Linux (ARM64, FortiOS).

Profile.

Malware.

PickleShell Reverse Shell.

PickleShell is a lightweight reverse shell on Windows.

Remote access trojan.
Windows.

Profile.

Malware.

PlugX.

Thoper, TVT, DestroyRAT.

PlugX is a remote access tool for Windows, built from plugins.

Remote access trojan.
Since 2012.
Windows.

Profile.

Malware.

PoisonIvy.

Poison Ivy, Breut.

PoisonIvy is a remote access tool (RAT) for Windows that MITRE describes as popular and used by many groups.

Remote access trojan.
Windows.

Profile.

Malware.

RedLine Stealer.

RedLine Stealer is information-stealing malware that MITRE says was first identified in 2020.

Infostealer.
Since 2020.
Windows.

Profile.

Malware.

REvil.

Sodinokibi, Sodin.

REvil, also called Sodinokibi and Sodin, is ransomware for Windows.

Ransomware.
Since 2019.
Windows.

Profile.

Malware.

ROKRAT.

ROKRAT is a cloud-based remote access tool for Windows.

Remote access trojan.
Since 2016.
Windows.

Profile.

Malware.

ROMULUS ClickFix Delivery Platform: LegionLoader And Other Payloads.

ROMULUS is a ClickFix delivery platform that Forescout's Vedere Labs described on 15 October 2026.

Framework.
Windows.

Profile.

Malware.

SAWFLY Web Shell.

SAWFLY is a small PHP web shell that Google Threat Intelligence Group says a suspected China-nexus espionage group used on BeyondTrust Remote Support appliances in 2026.

Profile.

Malware.

ShadowPad.

POISONPLUG.SHADOW.

ShadowPad is a modular backdoor for Windows.

Remote access trojan.
Since 2017.
Windows.

Profile.

Malware.

Shai-Hulud.

Shai-Hulud is a self-replicating worm that spreads through npm packages and code repositories.

Framework.
Since 2025.
Linux, SaaS, Windows.

Profile.

Malware.

SHINYROAD Backdoor.

SHINYROAD is the name Google Threat Intelligence Group and Mandiant give to a backdoor installed after a tampered AOMEI Backupper update in 2026.

Remote access trojan.
Since 2026.
Windows.

Profile.

Malware.

Snake (Uroburos).

Uroburos, Snake.

Snake, also called Uroburos, is a cyber espionage implant written in C, with versions for Windows, Linux and macOS.

Remote access trojan.
Since 2003.
Linux, Windows, macOS.

Profile.

Malware.

SUNBURST.

Solorigate.

SUNBURST is a trojanized Windows DLL built to fit inside the SolarWinds Orion software update framework.

Remote access trojan.
Since 2020.
Windows.

Profile.

Malware.

TAMECAT.

TAMECAT is a PowerShell backdoor that MITRE ATT&CK lists as used by APT42 to run PowerShell or C# content.

Remote access trojan.
Windows.

Profile.

Malware.

TeamPCP Cloud Stealer.

SANDCLOCK.

TeamPCP Cloud Stealer is a credential stealer that checks more than 50 file paths on build servers, cloud accounts and developer machines.

Infostealer.
Since 2026.

Profile.

Malware.

TruffleHog.

TruffleHog is a legitimate open source tool that searches for leaked passwords, API keys and other secrets in code, logs, chats and cloud storage.

Legitimate tool abused.
Since 2016.
IaaS, Linux, SaaS, Windows.

Profile.

Malware.

Ulej (Russian for beehive) is a custom data theft capability that the joint advisory AA26-204A describes as used by the Russian state-supported group LAUNDRY BEAR against Zimbra Collaboration Suite webmail.