Malware
AcidRain
AcidRain is a wiper built as an ELF program for modems and routers that use MIPS processors.
- Wiper
- Since 2022
- Network Devices, Linux
Profile
Threat Library
Malware And Tools. What They Do.
The malware families and tools that show up again and again in attacks, what they do and how to spot them.
Malware
Akira
Akira_v2
Akira is ransomware that locks files on a victim network and is used to demand payment.
- Ransomware
- Windows
Profile
Malware
Bad Rabbit
Win32/Diskcoder.D
Bad Rabbit is self-propagating ransomware for Windows.
- Ransomware
- Windows
Profile
Malware
Black Basta
Black Basta is ransomware, offered to criminal affiliates as a service, that encrypts files on Windows and VMware ESXi systems and steals data to pressure victims into paying.
- Ransomware
- Since 2022
- Windows, ESXi
Profile
Malware
BlackCat
ALPHV, Noberus
BlackCat is ransomware written in Rust that was offered to criminal affiliates as a ransomware-as-a-service.
- Ransomware
- Since 2021
- Linux, Windows
Profile
Malware
BlackEnergy
BlackEnergy 2, BlackEnergy 3
BlackEnergy is a malware toolkit for Windows.
- Framework
- Since 2007
- Windows
Profile
Malware
CaddyWiper
Caddy Wiper
CaddyWiper is destructive malware for Windows that overwrites files and drive structures.
- Wiper
- Since 2022
- Windows
Profile
Malware
CanisterWorm
CanisterWorm is a self-propagating worm that steals cloud and developer credentials and uses stolen npm tokens to push itself into more software packages.
- Infostealer
- Since 2026
- Containers, Linux
Profile
Malware
China Chopper
caidao.exe
China Chopper is a small web shell that attackers place on a web server to get remote access to it.
- Legitimate tool abused
- Windows
Profile
Malware
Clop
Clop is ransomware for Windows that locks files and adds its own file extension.
- Ransomware
- Since 2019
- Windows
Profile
Malware
Cobalt Strike
Cobalt Strike Beacon
Cobalt Strike is a commercial remote access tool sold for adversary simulation, which means security teams use it to test their own networks.
- Legitimate tool abused
- Since 2012
- Linux, macOS, Windows
Profile
Malware
Conti
Conti is ransomware that steals a victim's files, encrypts Windows systems and then demands payment.
- Ransomware
- Since 2019
- Windows
Profile
Malware
Crimson RAT
MSIL/Crimson
Crimson RAT is a remote access trojan for Windows.
- Remote access trojan
- Since 2016
- Windows
Profile
Malware
Cyclops Blink
Cyclops Blink is modular malware that runs on small office and home office network devices, mainly WatchGuard devices.
- Botnet
- Since 2019
- Network Devices
Profile
Malware
Derusbi
Derusbi/PHOTO
Derusbi is malware that MITRE ATT&CK says is used by multiple Chinese APT groups.
- Remote access trojan
- Windows, Linux
Profile
Malware
Dtrack
Dtrack is spyware for Windows that MITRE ATT&CK says was discovered in 2019.
- Remote access trojan
- Windows
Profile
Malware
Emotet
Geodo
Emotet is a modular Windows malware that began as a banking Trojan and became a loader, a tool that installs other malware such as banking Trojans or ransomware.
- Loader
- Since 2014
- Windows
Profile
Malware
Evilginx
evilginx2, EvilGinx
Evilginx is a free, open source toolkit that sits between a victim and a real website and copies what passes through, including passwords and login session cookies.
- Legitimate tool abused
Profile
Malware
FASTCash
FASTCash 2.0, FASTCash for UNIX, FASTCash for Windows
FASTCash is the name the US Government gives to an ATM cash-out scheme and the malware behind it.
- Remote access trojan
- Since 2016
- AIX, Windows
Profile
Malware
Gh0st RAT
Mydoor, Moudoor, Gh0stRAT
gh0st RAT is a remote access tool for Windows and macOS.
- Remote access trojan
- Windows, macOS
Profile
Malware
HOPLIGHT
HOPLIGHT is a backdoor Trojan for Windows.
- Remote access trojan
- Windows
Profile
Malware
Impacket
Impacket is a free, open source set of Python modules for working with network protocols.
- Legitimate tool abused
- Linux, macOS, Windows
Profile
Malware
Industroyer
CRASHOVERRIDE, Win32/Industroyer
Industroyer, also called CrashOverride, is a malware framework built to disrupt industrial control systems, specifically parts used in electrical substations.
- Framework
- Since 2016
- Windows
Profile
Malware
Infamous Chisel
Infamous Chisel is a collection of components that targets Android devices.
- Remote access trojan
- Android
Profile
Malware
Kazuar
Kazuar v2, KazuarV2, Kazuar v3
Kazuar is a backdoor Trojan that runs on Windows and macOS.
- Remote access trojan
- Windows, macOS
Profile
Malware
KV Botnet
KV Botnet Activity
KV Botnet is malware that took over small office and home office routers and linked them into a botnet.
- Botnet
Profile
Malware
Mimikatz
Mimikatz is a tool that pulls Windows account logins and passwords out of a computer.
- Legitimate tool abused
- Since 2007
- Windows
Profile
Malware
Mini Shai-Hulud
Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines.
- Infostealer
- Since 2026
Profile
Malware
NICECURL
NICECURL is a backdoor written in VBScript.
- Remote access trojan
- Windows
Profile
Malware
NotPetya
ExPetr, Diskcoder.C, Petrwrap
NotPetya is destructive malware that looks like ransomware.
- Wiper
- Since 2017
- Windows
Profile
Malware
Olympic Destroyer
Olympic Destroyer is a Windows wiper that was used against computers supporting the 2018 Winter Olympics in Pyeongchang, South Korea.
- Wiper
- Since 2018
- Windows
Profile
Malware
PlugX
Thoper, TVT, DestroyRAT
PlugX is a remote access tool for Windows, built from plugins.
- Remote access trojan
- Since 2012
- Windows
Profile
Malware
PoisonIvy
Poison Ivy, Breut
PoisonIvy is a remote access tool (RAT) for Windows that MITRE describes as popular and used by many groups.
- Remote access trojan
- Windows
Profile
Malware
RedLine Stealer
RedLine Stealer is information-stealing malware that MITRE says was first identified in 2020.
- Infostealer
- Since 2020
- Windows
Profile
Malware
REvil
Sodinokibi, Sodin
REvil, also called Sodinokibi and Sodin, is ransomware for Windows.
- Ransomware
- Since 2019
- Windows
Profile
Malware
ROKRAT
ROKRAT is a cloud-based remote access tool for Windows.
- Remote access trojan
- Since 2016
- Windows
Profile
Malware
ShadowPad
POISONPLUG.SHADOW, PoisonPlug, Barlaiy
ShadowPad is a modular backdoor for Windows.
- Remote access trojan
- Since 2017
- Windows
Profile
Malware
Shai-Hulud
Shai-Hulud 2.0
Shai-Hulud is a self-replicating worm that spreads through npm packages and code repositories.
- Framework
- Since 2025
- Linux, SaaS, Windows
Profile
Malware
Snake (Uroburos)
Uroburos, Snake
Snake, also called Uroburos, is a cyber espionage implant written in C, with versions for Windows, Linux and macOS.
- Remote access trojan
- Since 2003
- Linux, Windows, macOS
Profile
Malware
SUNBURST
Solorigate
SUNBURST is a trojanized Windows DLL built to fit inside the SolarWinds Orion software update framework.
- Remote access trojan
- Since 2020
- Windows
Profile
Malware
TAMECAT
TAMECAT is a PowerShell backdoor that MITRE ATT&CK lists as used by APT42 to run PowerShell or C# content.
- Remote access trojan
- Windows
Profile
Malware
TeamPCP Cloud Stealer
SANDCLOCK
TeamPCP Cloud Stealer is a credential stealer that checks more than 50 file paths on build servers, cloud accounts and developer machines.
- Infostealer
- Since 2026
Profile
Malware
TruffleHog
Trufflehog
TruffleHog is a legitimate open source tool that searches for leaked passwords, API keys and other secrets in code, logs, chats and cloud storage.
- Legitimate tool abused
- Since 2016
- IaaS, Linux, SaaS, Windows
Profile
Malware
Ulej
Улей, Beehive, Flowerbed
Ulej (Russian for beehive) is a custom data theft capability that the joint advisory AA26-204A describes as used by the Russian state-supported group LAUNDRY BEAR against Zimbra…
- Infostealer
- Since 2025
Profile
Malware
VersaMem
VersaMem is a web shell that MITRE ATT&CK says was built for Versa Director servers, which help manage SD-WAN networks.
- Remote access trojan
- Since 2024
- Network Devices
Profile
Malware
WannaCry
WanaCry, WanaCrypt, WanaCrypt0r
WannaCry is ransomware that spreads on its own across a network like a worm and encrypts the files it finds.
- Ransomware
- Since 2017
- Windows
Profile
Nothing matches. Try another word or filter.
More In The Library.
Counts as of 17 October 2026
- 101 Guides Short, plain guides to the main ideas in external threat protection. 21 Guides
- Glossary Security terms in plain words, A to Z, each with its own page. 135 Terms
- APT Groups State-backed hacking groups, who they go after and how they get in. 49 Profiles
- Ransomware Groups How each group gets in, how it extorts and what stops it. 24 Profiles
- Malware And Tools Malware families and abused tools, what they do and how to spot them. 46 Profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 Profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 Profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 Profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 Profiles
- Agentic Security Best practices for securing AI agents and for using agents in security work, from the main public frameworks. 12 Articles
- How To Defend A playbook for every alert: the first 24 hours, the checklist and the fix. 18 Playbooks
Brandefense
Stay Ahead Of Digital Threats.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.