LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0283: jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

EnterpriseS0283MalwareObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

jRAT matters because it represents a commodity, cross-platform Java-based backdoor rather than a single Windows-only threat. For leaders, the practical issue is whether endpoint, network, and incident response processes can recognize remote-access behavior across Windows, Linux, macOS, and Android, especially when files may be obfuscated or packed and when the toolset supports discovery, collection, command-and-control, and persistence-related behaviors.

Executive priority

Prioritize jRAT as a validation case for resilience against commodity remote access tooling. The ATT&CK relationships show behaviors that can affect credential exposure, sensitive data collection, lateral movement via RDP, tool transfer, proxying, and exfiltration timing. Executives should ask whether monitoring coverage extends beyond Windows, whether Java-based and obfuscated payloads are handled in malware triage, and whether SOC and IR teams can assemble evidence across endpoint, network, identity, and user activity during a suspected backdoor incident.

Technical view

ATT&CK provides no dedicated detection text for jRAT, so defenders should validate coverage through the related techniques. Focus on correlated behavior: Java or script execution followed by system, process, service, file, network, and peripheral discovery; collection activity such as keylogging, screen capture, clipboard access, or audio capture; command-and-control indicators such as proxy use and ingress tool transfer; Windows-specific execution or movement through cmd, WMI, and RDP; macOS startup item persistence where applicable; and cleanup behavior such as file deletion. Because the object is cross-platform, test telemetry and playbooks separately for Windows, Linux, macOS, and Android rather than assuming one control path applies everywhere.

Likely telemetry

  • Endpoint process creation and command-line telemetry for Java, Windows command shell, WMI, Visual Basic, and JavaScript execution where applicable
  • Endpoint file telemetry for packed or obfuscated files, dropped tools, startup items on macOS, and file deletion
  • Host discovery telemetry for services, processes, system information, files/directories, network configuration, network connections, and peripheral devices
  • Network telemetry for outbound command-and-control patterns, proxy use, scheduled or periodic transfers, and tool ingress
  • Identity and remote access logs for RDP sessions and valid-account use on Windows systems

Detection direction

  • Build detections around behavior chains rather than a single malware name, since the official object notes variants and SaaS-style distribution and provides no official detection guidance.
  • Tune for unusual Java-based execution combined with discovery commands, collection behavior, or outbound network connections across supported platforms.
  • Validate Windows coverage for cmd, WMI, and RDP activity in proximity to suspicious remote-access behavior; account for legitimate administration to reduce false positives.
  • Validate Linux and macOS coverage for discovery commands, file enumeration, network enumeration, tool transfer, and macOS startup item changes.
  • Treat obfuscation and software packing as triage drivers: confirm that static signature misses are compensated by sandboxing, memory/runtime analysis, or behavior analytics.

Mitigation priorities

  • Inventory where Java runtime and scripting capabilities are required, and reduce unnecessary exposure where business operations allow.
  • Harden and monitor remote access paths, especially RDP on Windows, with strong identity controls and reviewable logs.
  • Improve endpoint controls for cross-platform malware execution, obfuscated files, packed payloads, and unauthorized tool transfer.
  • Restrict and monitor persistence locations, including macOS startup items where still present.
  • Strengthen egress monitoring and proxy governance to make command-and-control and scheduled transfer behavior easier to investigate.
Additional notes and limits

The supplied ATT&CK object identifies jRAT as a cross-platform Java-based backdoor originally available for purchase in 2012, with variants distributed through a SaaS-like model. Relationship context links it to TA2541 use and to techniques spanning discovery, execution, persistence, collection, command-and-control, lateral movement, exfiltration, and defense evasion. The most defensible operational approach is behavior-based validation across the related ATT&CK techniques.

MITRE provides no official detection text, no malware-specific tactics field, and no guaranteed indicators or active-exploitation claims in the supplied data. Local conclusions require environment evidence such as endpoint logs, network flows, identity records, malware samples, and platform scope. Android is listed as a platform, but the supplied relationship techniques do not provide Android-specific detection detail.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

28 rows
DomainIDNameRelationship / procedure
EnterpriseT1056.001KeyloggingSub-technique

jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.[2][1]

EnterpriseT1120Peripheral Device Discovery

jRAT can map UPnP ports.[1]

EnterpriseT1029Scheduled Transfer

jRAT can be configured to reconnect at certain intervals.[1]

EnterpriseT1047Windows Management Instrumentation

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.[2]

EnterpriseT1059.005Visual BasicSub-technique

jRAT has been distributed as HTA files with VBScript.[1]

EnterpriseT1125Video Capture

jRAT has the capability to capture video from a webcam.[2][1]

EnterpriseT1059.003Windows Command ShellSub-technique

jRAT has command line access.[1]

EnterpriseT1007System Service Discovery

jRAT can list local services.[1]

EnterpriseT1070.004File DeletionSub-technique

jRAT has a function to delete files from the victim’s machine.[2]

EnterpriseT1082System Information Discovery

jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.[4]

EnterpriseT1037.005Startup ItemsSub-technique

jRAT can list and manage startup entries.[1]

EnterpriseT1105Ingress Tool Transfer

jRAT can download and execute files.[2][1][4]

EnterpriseT1057Process Discovery

jRAT can query and kill system processes.[4]

EnterpriseT1083File and Directory Discovery

jRAT can browse file systems.[1][4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

jRAT can support RDP control.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.[1]

EnterpriseT1027.002Software PackingSub-technique

jRAT payloads have been packed.[1]

EnterpriseT1518.001Security Software DiscoverySub-technique

jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.[2][1]

EnterpriseT1090Proxy

jRAT can serve as a SOCKS proxy server.[1]

EnterpriseT1059.007JavaScriptSub-technique

jRAT has been distributed as HTA files with JScript.[1]

EnterpriseT1115Clipboard Data

jRAT can capture clipboard data.[1]

EnterpriseT1552.001Credentials In FilesSub-technique

jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.[1]

EnterpriseT1123Audio Capture

jRAT can capture microphone recordings.[1]

EnterpriseT1113Screen Capture

jRAT has the capability to take screenshots of the victim’s machine.[2][1]

EnterpriseT1049System Network Connections Discovery

jRAT can list network connections.[1]

EnterpriseT1027Obfuscated Files or Information

jRAT’s Java payload is encrypted with AES.[2] Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.[4]

EnterpriseT1016System Network Configuration Discovery

jRAT can gather victim internal and external IPs.[1]

EnterpriseT1552.004Private KeysSub-technique

jRAT can steal keys for VPNs and cryptocurrency wallets.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1120: Peripheral Device DiscoveryEnterpriseuses · TechniqueT1029: Scheduled TransferEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1125: Video CaptureEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · GroupG1018: TA2541Enterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1037.005: Startup ItemsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1123: Audio CaptureEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.2
Created
Modified
Raw hash
4f1fc8fa498e8541...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.2Current bundle4f1fc8fa498e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  2. [2]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  3. [3]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  4. [4]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  5. [5]
    Adwind

    (Citation: Kaspersky Adwind Feb 2016)

  6. [6]
    Adwind

    (Citation: Kaspersky Adwind Feb 2016)

  7. [7]
    Adwind

    (Citation: Kaspersky Adwind Feb 2016)

  8. [8]
    AlienSpy

    (Citation: Kaspersky Adwind Feb 2016)

  9. [9]
    AlienSpy

    (Citation: Kaspersky Adwind Feb 2016)

  10. [10]
    AlienSpy

    (Citation: Kaspersky Adwind Feb 2016)

  11. [11]
    Frutas

    (Citation: Kaspersky Adwind Feb 2016)

  12. [12]
    Frutas

    (Citation: Kaspersky Adwind Feb 2016)

  13. [13]
    Frutas

    (Citation: Kaspersky Adwind Feb 2016)

  14. [14]
    JSocket

    (Citation: Kaspersky Adwind Feb 2016)

  15. [15]
    JSocket

    (Citation: Kaspersky Adwind Feb 2016)

  16. [16]
    JSocket

    (Citation: Kaspersky Adwind Feb 2016)

  17. [17]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  18. [18]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  19. [19]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  20. [20]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  21. [21]
    NCSC Joint Report Public Tools

    The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.

    Open source URL
  22. [22]
    Sockrat

    (Citation: Kaspersky Adwind Feb 2016)

  23. [23]
    Sockrat

    (Citation: Kaspersky Adwind Feb 2016)

  24. [24]
    Sockrat

    (Citation: Kaspersky Adwind Feb 2016)

  25. [25]
    Trojan.Maljava

    (Citation: jRAT Symantec Aug 2018)

  26. [26]
    Trojan.Maljava

    (Citation: jRAT Symantec Aug 2018)

  27. [27]
    Trojan.Maljava

    (Citation: jRAT Symantec Aug 2018)

  28. [28]
    Unrecom

    (Citation: Kaspersky Adwind Feb 2016)

  29. [29]
    Unrecom

    (Citation: Kaspersky Adwind Feb 2016)

  30. [30]
    Unrecom

    (Citation: Kaspersky Adwind Feb 2016)

  31. [31]
    jBiFrost

    (Citation: NCSC Joint Report Public Tools)

  32. [32]
    jBiFrost

    (Citation: NCSC Joint Report Public Tools)

  33. [33]
    jBiFrost

    (Citation: NCSC Joint Report Public Tools)

  34. [34]
    jFrutas

    (Citation: Kaspersky Adwind Feb 2016)

  35. [35]
    jFrutas

    (Citation: Kaspersky Adwind Feb 2016)

  36. [36]
    jFrutas

    (Citation: Kaspersky Adwind Feb 2016)

  37. [37]
    jRAT

    (Citation: jRAT Symantec Aug 2018)

  38. [38]
    jRAT

    (Citation: jRAT Symantec Aug 2018)

  39. [39]
    jRAT

    (Citation: jRAT Symantec Aug 2018)

  40. [40]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  41. [41]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  42. [42]
    mitre-attackS0283
    Open source URL
  43. [43]
    mitre-attackS0283
    Open source URL
  44. [44]
    mitre-attackS0283
    Open source URL
  45. [45]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  46. [46]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  47. [47]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  48. [48]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  49. [49]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  50. [50]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  51. [51]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  52. [52]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  53. [53]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  54. [54]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  55. [55]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  56. [56]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  57. [57]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  58. [58]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  59. [59]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  60. [60]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  61. [61]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  62. [62]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  63. [63]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  64. [64]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  65. [65]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  66. [66]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  67. [67]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  68. [68]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  69. [69]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  70. [70]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  71. [71]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  72. [72]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  73. [73]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  74. [74]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  75. [75]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  76. [76]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  77. [77]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  78. [78]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  79. [79]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  80. [80]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  81. [81]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  82. [82]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  83. [83]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  84. [84]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  85. [85]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  86. [86]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  87. [87]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  88. [88]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  89. [89]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  90. [90]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  91. [91]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  92. [92]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  93. [93]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  94. [94]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  95. [95]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  96. [96]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  97. [97]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  98. [98]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  99. [99]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  100. [100]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  101. [101]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  102. [102]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  103. [103]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  104. [104]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  105. [105]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  106. [106]
    Symantec Frutas Feb 2013

    Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.

    Open source URL
  107. [107]
    jRAT Symantec Aug 2018

    Sharma, R. (2018, August 15). Revamped jRAT Uses New Anti-Parsing Techniques. Retrieved September 21, 2018.

    Open source URL
  108. [108]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
  109. [109]
    Kaspersky Adwind Feb 2016

    Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use