{
  "family": "revenge",
  "sample_count": 41,
  "category": "backdoor",
  "description": "Revenge (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/Revenge, Backdoor:MSIL/RevengeRAT, and RevengeRAT) is a prominent, commercial .NET remote access trojan (RAT) first released on underground hacking forums in 2016. Developed by an actor using the handle 'Revenge-Software', the tool gained widespread adoption among both cybercrime syndicates and advanced persistent threat (APT) actors due to its lightweight footprint, stability, and extensive feature set. Once executed, RevengeRAT establishes startup persistence via Windows Registry Run keys, conducts system reconnaissance, and establishes an encrypted TCP socket connection to attacker C2 servers. RevengeRAT features comprehensive surveillance capabilities, including real-time keystroke logging, desktop screen streaming, webcam and audio recording, credential dumping, and remote shell execution.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Revenge",
    "Backdoor:MSIL/RevengeRAT",
    "RevengeRAT",
    "Win32/Revenge",
    "Trojan:MSIL/RevengeRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Revenge (RevengeRAT)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "RevengeRAT is a commercial .NET remote access trojan providing attackers with complete interactive control over compromised endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does RevengeRAT possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It includes real-time keystroke logging, screen capture, microphone/webcam recording, and browser credential theft."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers distribute RevengeRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through targeted spearphishing emails with weaponized office documents, ISO/VHD images, and malicious VBS/PowerShell loaders."
      }
    },
    {
      "@type": "Question",
      "name": "How does RevengeRAT maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart values to Windows Registry Run keys and can create scheduled tasks disguised as system services."
      }
    },
    {
      "@type": "Question",
      "name": "How can defenders identify RevengeRAT on a network?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for anomalous outbound TCP connections from .NET processes and inspect memory for known RevengeRAT C2 protocol headers."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1125",
    "T1123",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": "Revenge-Software (Author) / Multiple Cybercrime & APT Groups",
  "delivery_mechanism": [
    "Spearphishing Emails with Weaponized Documents",
    "ISO/VHD Container Payloads",
    "Malicious PowerShell and VBS Stagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Interactive Remote Shell Execution",
    "Real-Time Keystroke Logging",
    "Desktop Screenshot Streaming",
    "Webcam & Microphone Audio Surveillance",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET MSIL PE Executable",
      "Win32 Standalone Binary"
    ],
    "network_signatures": [
      "Custom TCP socket handshakes exchanging base64-encoded system telemetry and victim IDs",
      "Periodic TCP keep-alive packets on high non-standard ports"
    ],
    "evasion_techniques": [
      "Obfuscating .NET assemblies using ConfuserEx or customized crypters",
      "Terminating when virtualization or sandbox artifacts are detected"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b15df726489312bcf8194ad92716492758193859",
      "19e48b3b42f2b3e449a57291dc8f781bb49f8b15"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RevengeRAT"
    ],
    "file_paths": [
      "%AppData%\\RevengeRAT\\client.exe",
      "%Temp%\\revenge_log.tmp"
    ]
  },
  "defensive_measures": [
    "Block inbound executable and archive files at organizational email gateways",
    "Deploy endpoint detection rules for unauthorized .NET processes opening raw TCP sockets",
    "Audit Windows Registry Run keys and user startup directories regularly"
  ],
  "sources": [
    {
      "name": "MITRE ATT&CK Software Profile - Revenge RAT (S0379)",
      "url": "https://attack.mitre.org/software/S0379/"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:MSIL/RevengeRAT",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:MSIL/RevengeRAT"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:MSIL/RevengeRAT.A",
      "RevengeRAT v0.3"
    ]
  },
  "motivation": "Cyber espionage, Remote Endpoint Control & Information Theft",
  "sample_hashes": []
}