LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0670: WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

EnterpriseS0670MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

WarzoneRAT is a publicly available malware-as-a-service remote access tool for Windows. Its business significance is that commodity RAT capability can give an intruder interactive control, credential collection, discovery, file access, and data theft paths without requiring custom malware. For leaders, this makes coverage less about one malware name and more about whether Windows endpoint, identity, remote access, and network monitoring can expose RAT-style behavior early enough to contain it.

Executive priority

Prioritize WarzoneRAT as a resilience and readiness test case for commodity remote access malware. The ATT&CK relationships connect it to collection, credential access, discovery, command and control, lateral movement via RDP/VNC, registry modification, process injection, and exfiltration over C2. Executives should ask whether the organization can prove visibility into Windows endpoint execution, suspicious remote access, credential capture indicators, and outbound C2-like traffic. Because ATT&CK lists use by multiple groups, including Confucius, Scattered Spider, and TA2541, the behavior is relevant to threat-informed defense, but local risk should be based on the organization’s sector, exposure, and telemetry rather than assuming current targeting.

Technical view

ATT&CK does not provide a dedicated detection section for WarzoneRAT, so SOC and IR teams should validate behavior-based coverage across the related techniques. On Windows, focus on malicious-file execution, PowerShell and cmd activity, native API use, process injection, registry modification, process/system/file discovery, keylogging indicators, video capture attempts, ingress tool transfer, proxy or non-application-layer C2 patterns, RDP/VNC activity, and exfiltration over an established C2 channel. Detection engineering should map alerts and hunts to the related ATT&CK techniques rather than relying only on static malware naming.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • PowerShell execution logs and script block/module logging where available
  • Windows registry modification events
  • Endpoint detection telemetry for process injection, API abuse, and suspicious memory behavior
  • File creation, download, and tool transfer evidence

Detection direction

  • Validate detections for the related behaviors, especially T1059.001, T1059.003, T1055, T1112, T1056.001, T1021.001, T1021.005, T1041, T1090, T1095, and T1105.
  • Tune for context: administrative PowerShell, remote support tools, RDP, VNC, and registry changes are common in enterprises and need baselines, allowlists, and change-management context to reduce false positives.
  • Hunt for behavior chains rather than isolated events: user-opened file followed by script or shell execution, discovery commands, registry changes, network beaconing, and remote access activity is more meaningful than any single signal.
  • Confirm visibility on Windows endpoints where the malware platform is supported; do not assume coverage from network-only monitoring because process injection, keylogging, registry changes, and local discovery are host-centric.
  • Review blind spots around unmanaged endpoints, weak PowerShell logging, encrypted outbound traffic, legitimate remote access infrastructure, and incomplete egress monitoring.

Mitigation priorities

  • Reduce initial execution risk by hardening handling of user-opened files and enforcing controls around scripts, attachments, and downloaded executables.
  • Strengthen Windows endpoint controls and monitoring for process injection, suspicious script execution, registry persistence or defense-impairment changes, and unauthorized tool transfer.
  • Restrict and monitor RDP and VNC usage with least privilege, strong authentication, and clear administrative baselines.
  • Apply identity and access controls that limit the value of captured credentials, including privileged access separation and monitoring of unusual interactive logons.
  • Control egress paths with proxy, firewall, and network monitoring policies that make unauthorized C2 and exfiltration channels harder to sustain.
Additional notes and limits

WarzoneRAT is described by ATT&CK as a C++ malware-as-a-service RAT publicly available since at least late 2018. ATT&CK relationships show use by Confucius, Scattered Spider, and TA2541 and map the software to a broad set of techniques spanning execution, discovery, collection, credential access, command and control, lateral movement, stealth, persistence, and exfiltration. The most useful defensive value is to test whether the organization can detect and investigate RAT behavior on Windows across host, identity, and network telemetry.

The official ATT&CK object does not specify tactics directly and provides no official detection guidance. This take is therefore based on the supplied description, external references, Windows platform field, and listed relationships. It does not assert active exploitation, current targeting, specific indicators, guaranteed detection, or applicability to non-Windows deployments beyond the related technique descriptions.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

WarzoneRAT

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

30 rows
DomainIDNameRelationship / procedure
EnterpriseT1057Process Discovery

WarzoneRAT can obtain a list of processes on a compromised host.[1]

EnterpriseT1056.001KeyloggingSub-technique

WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.[1]

EnterpriseT1204.002Malicious FileSub-technique

WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.[1][3]

EnterpriseT1685Disable or Modify Tools

WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.[1]

EnterpriseT1041Exfiltration Over C2 Channel

WarzoneRAT can send collected victim data to its C2 server.[1]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.[1][2]

EnterpriseT1548.002Bypass User Account ControlSub-technique

WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.[1][2]

EnterpriseT1005Data from Local System

WarzoneRAT can collect data from a compromised host.[1]

EnterpriseT1105Ingress Tool Transfer

WarzoneRAT can download and execute additional files.[1]

EnterpriseT1082System Information Discovery

WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.[1]

EnterpriseT1090Proxy

WarzoneRAT has the capability to act as a reverse proxy.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.[1]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

WarzoneRAT has the ability to control an infected PC using RDP.[1]

EnterpriseT1112Modify Registry

WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.[2][1]

EnterpriseT1546.015Component Object Model HijackingSub-technique

WarzoneRAT can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.[1]

EnterpriseT1564Hide Artifacts

WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

WarzoneRAT has been distributed as a malicious attachment within an email.[1][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.[1]

EnterpriseT1059.001PowerShellSub-technique

WarzoneRAT can use PowerShell to download files and execute commands.[1][2]

EnterpriseT1106Native API

WarzoneRAT can use a variety of API calls on a compromised host.[2]

EnterpriseT1125Video Capture

WarzoneRAT can access the webcam on a victim's machine.[1][2]

EnterpriseT1564.003Hidden WindowSub-technique

WarzoneRAT has the ability of performing remote desktop access via a hVNC window for decreased visibility.[7]

EnterpriseT1055Process Injection

WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

WarzoneRAT can use `cmd.exe` to execute malicious code.[1]

EnterpriseT1021.005VNCSub-technique

WarzoneRAT has the ability of performing remote desktop access via a VNC console.[1]

EnterpriseT1221Template Injection

WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.[3]

EnterpriseT1095Non-Application Layer Protocol

WarzoneRAT can communicate with its C2 server via TCP over port 5200.[1]

EnterpriseT1083File and Directory Discovery

WarzoneRAT can enumerate directories on a compromise host.[1]

EnterpriseT1014Rootkit

WarzoneRAT can include a rootkit to hide processes, files, and startup.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

GroupEnterprise

G1015: Scattered Spider

Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]

GroupEnterprise

G0142: Confucius

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · GroupG1018: TA2541Enterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · GroupG1015: Scattered SpiderEnterpriseuses · TechniqueT1546.015: Component Object Model HijackingEnterpriseuses · TechniqueT1564: Hide ArtifactsEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · GroupG0142: ConfuciusEnterpriseuses · TechniqueT1106: Native APIEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
30f19fc196029cea...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle30f19fc19602…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  2. [2]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  3. [3]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  4. [4]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  5. [5]
    CISA Scattered Spider Advisory November 2023

    CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.

    Open source URL
  6. [6]
    Check Point Scattered Spider JUL 2025

    Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.

    Open source URL
  7. [7]
    Bitdefender Trickbot VNC module Whitepaper 2021

    Radu Tudorica. (2021, July 12). A Fresh Look at Trickbot’s Ever-Improving VNC Module. Retrieved September 28, 2021.

    Open source URL
  8. [8]
    Ave Maria

    (Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)

  9. [9]
    Ave Maria

    (Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)

  10. [10]
    Ave Maria

    (Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)

  11. [11]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  12. [12]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  13. [13]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  14. [14]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  15. [15]
    mitre-attackS0670
    Open source URL
  16. [16]
    mitre-attackS0670
    Open source URL
  17. [17]
    mitre-attackS0670
    Open source URL
  18. [18]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  19. [19]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  20. [20]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  21. [21]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  22. [22]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  23. [23]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  24. [24]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  25. [25]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  26. [26]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  27. [27]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  28. [28]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  29. [29]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  30. [30]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  31. [31]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  32. [32]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  33. [33]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  34. [34]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  35. [35]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  36. [36]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  37. [37]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  38. [38]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  39. [39]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  40. [40]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  41. [41]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  42. [42]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  43. [43]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  44. [44]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  45. [45]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  46. [46]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  47. [47]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  48. [48]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  49. [49]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  50. [50]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  51. [51]
    Proofpoint TA2541 February 2022

    Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.

    Open source URL
  52. [52]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  53. [53]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  54. [54]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  55. [55]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  56. [56]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  57. [57]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  58. [58]
    CISA Scattered Spider Advisory November 2023

    CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.

    Open source URL
  59. [59]
    Check Point Scattered Spider JUL 2025

    Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.

    Open source URL
  60. [60]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  61. [61]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  62. [62]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  63. [63]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  64. [64]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  65. [65]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  66. [66]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  67. [67]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  68. [68]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  69. [69]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  70. [70]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  71. [71]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  72. [72]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  73. [73]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  74. [74]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  75. [75]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  76. [76]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  77. [77]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  78. [78]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  79. [79]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  80. [80]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  81. [81]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  82. [82]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  83. [83]
    Uptycs Warzone UAC Bypass November 2020

    Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.

    Open source URL
  84. [84]
    Bitdefender Trickbot VNC module Whitepaper 2021

    Radu Tudorica. (2021, July 12). A Fresh Look at Trickbot’s Ever-Improving VNC Module. Retrieved September 28, 2021.

    Open source URL
  85. [85]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  86. [86]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  87. [87]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  88. [88]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  89. [89]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  90. [90]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  91. [91]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  92. [92]
    Uptycs Confucius APT Jan 2021

    Uptycs Threat Research Team. (2021, January 12). Confucius APT deploys Warzone RAT. Retrieved December 17, 2021.

    Open source URL
  93. [93]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  94. [94]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  95. [95]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  96. [96]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
  97. [97]
    Check Point Warzone Feb 2020

    Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use