ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool WolfRAT

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: WolfRAT

NamesWolfRAT
W1_RAT
CategoryMalware
TypeReconnaissance, Backdoor, Keylogger, Info stealer, Exfiltration
Description(Talos) Cisco Talos has discovered a new Android malware based on a leak of the Dendroid malware family. We named this malware 'WolfRAT' due to strong links between this malware (and the command and control (C2) infrastructure) and Wolf Research, an infamous organization that developed interception and espionage-based malware and was publicly described by CSIS during Virus Bulletin 2018. We identified infrastructure overlaps and string references to previous Wolf Research work. The organization appears to be shut down, but the threat actors are still very active.

We identified campaigns targeting Thai users and their devices. Some of the C2 servers are located in Thailand. The panels also contain Thai JavaScript comments and the domain names also contain references to Thai food, a tactic commonly employed to entice users to click/visit these C2 panels without much disruption.
Information<https://blog.talosintelligence.com/2020/05/the-wolf-is-back.html>
<https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/AncelKuprins-VB2018-WolfSheep.pdf>
<https://www.africacybersecurityconference.com/document/CrowdStrike_GTR_2019.pdf>

Last change to this tool card: 21 May 2020

Download this tool card in JSON format

Previous: WndTest
Next: Wormhole

All groups using tool WolfRAT

ChangedNameCountryObserved

APT groups

XLazarus Group, Hidden Cobra, Labyrinth ChollimaNorth Korea2007-Dec 2020 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key