S0670: WarzoneRAT
WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]
Security context for executives and security teams
S0670: WarzoneRAT describes [WarzoneRAT](https://attack.mitre.org/software/S0670) is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)
Executive priority
S0670: WarzoneRAT is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0670: WarzoneRAT by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0670: WarzoneRAT appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
WarzoneRAT
WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1057 | Process Discovery | WarzoneRAT can obtain a list of processes on a compromised host.[1] |
| Enterprise | T1056.001 | KeyloggingSub-technique | WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.[1][2] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.[1] |
| Enterprise | T1204.002 | Malicious FileSub-technique | WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.[1]CitationUptycs Confucius APT Jan 2021 |
| Enterprise | T1685 | Disable or Modify Tools | WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | WarzoneRAT can send collected victim data to its C2 server.[1] |
| Enterprise | T1555.003 | Credentials from Web BrowsersSub-technique | WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.[1][2] |
| Enterprise | T1548.002 | Bypass User Account ControlSub-technique | WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.[1][2] |
| Enterprise | T1005 | Data from Local System | WarzoneRAT can collect data from a compromised host.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | WarzoneRAT can download and execute additional files.[1] |
| Enterprise | T1082 | System Information Discovery | WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.[1] |
| Enterprise | T1090 | Proxy | WarzoneRAT has the capability to act as a reverse proxy.[1] |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.[1] |
| Enterprise | T1021.001 | Remote Desktop ProtocolSub-technique | WarzoneRAT has the ability to control an infected PC using RDP.[1] |
| Enterprise | T1112 | Modify Registry | WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.[2][1] |
| Enterprise | T1546.015 | Component Object Model HijackingSub-technique | WarzoneRAT can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.[1] |
| Enterprise | T1564 | Hide Artifacts | WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`.[1] |
| Enterprise | T1566.001 | Spearphishing AttachmentSub-technique | WarzoneRAT has been distributed as a malicious attachment within an email.[1]CitationUptycs Confucius APT Jan 2021 |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.[1] |
| Enterprise | T1059.001 | PowerShellSub-technique | WarzoneRAT can use PowerShell to download files and execute commands.[1][2] |
| Enterprise | T1106 | Native API | WarzoneRAT can use a variety of API calls on a compromised host.[2] |
| Enterprise | T1125 | Video Capture | WarzoneRAT can access the webcam on a victim's machine.[1][2] |
| Enterprise | T1564.003 | Hidden WindowSub-technique | WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.CitationBitdefender Trickbot VNC module Whitepaper 2021 |
| Enterprise | T1055 | Process Injection | WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.[1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | WarzoneRAT can use `cmd.exe` to execute malicious code.[1] |
| Enterprise | T1021.005 | VNCSub-technique | WarzoneRAT has the ability of performing remote desktop access via a VNC console.[1] |
| Enterprise | T1221 | Template Injection | WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.CitationUptycs Confucius APT Jan 2021 |
| Enterprise | T1095 | Non-Application Layer Protocol | WarzoneRAT can communicate with its C2 server via TCP over port 5200.[1] |
| Enterprise | T1083 | File and Directory Discovery | WarzoneRAT can enumerate directories on a compromise host.[1] |
| Enterprise | T1014 | Rootkit | WarzoneRAT can include a rootkit to hide processes, files, and startup.[1] |
Groups, software, and campaigns
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
G1018: TA2541
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]
G0142: Confucius
Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.[1][2][3]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | 30f19fc19602… | ||
| 19.1 | 1.1 | Older bundle | 30f19fc19602… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Check Point Warzone Feb 2020
Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
Open source URL - [2]Uptycs Warzone UAC Bypass November 2020
Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.
Open source URL - [3]Ave Maria
(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)
- [4]mitre-attackS0670Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.