S1063: Brute Ratel C4
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.[1][2][3][4][5]
Security context for executives and security teams
S1063: Brute Ratel C4 describes [Brute Ratel C4](https://attack.mitre.org/software/S1063) is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. [Brute Ratel C4](https://attack.mitre.org/software/S1063) was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of [Brute ...
Executive priority
S1063: Brute Ratel C4 is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1063: Brute Ratel C4 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1063: Brute Ratel C4 appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Brute Ratel C4
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.[1][2][3][4][5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1055.002 | Portable Executable InjectionSub-technique | Brute Ratel C4 has injected Latrodectus into the Explorer.exe process on comrpomised hosts.CitationRapid7 Fake W2 July 2024 |
| Enterprise | T1569.002 | Service ExecutionSub-technique | Brute Ratel C4 can create Windows system services for execution.[2] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Brute Ratel C4 can use cmd.exe for execution.[2] |
| Enterprise | T1021.006 | Windows Remote ManagementSub-technique | Brute Ratel C4 can use WinRM for pivoting.[2] |
| Enterprise | T1113 | Screen Capture | Brute Ratel C4 can take screenshots on compromised hosts.[2] |
| Enterprise | T1057 | Process Discovery | Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).[2] |
| Enterprise | T1027 | Obfuscated Files or Information | Brute Ratel C4 has used encrypted payload files and maintains an encrypted configuration structure in memory.[2][3] |
| Enterprise | T1047 | Windows Management Instrumentation | Brute Ratel C4 can use WMI to move laterally.[2] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | Brute Ratel C4 has used a payload file named OneDrive.update to appear benign.[2] |
| Enterprise | T1021.002 | SMB/Windows Admin SharesSub-technique | Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.[2][3][1] |
| Enterprise | T1005 | Data from Local System | Brute Ratel C4 has the ability to upload files from a compromised system.[2] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Brute Ratel C4 has the ability to deobfuscate its payload prior to execution.[2] |
| Enterprise | T1069.002 | Domain GroupsSub-technique | Brute Ratel C4 can use `net group` for discovery on targeted domains.[5] |
| Enterprise | T1572 | Protocol Tunneling | Brute Ratel C4 can use DNS over HTTPS for C2.[2][5] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | Brute Ratel C4 can detect EDR userland hooks.[2] |
| Enterprise | T1685 | Disable or Modify Tools | Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).[2][3] |
| Enterprise | T1036.008 | Masquerade File TypeSub-technique | Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.[2] |
| Enterprise | T1087.002 | Domain AccountSub-technique | Brute Ratel C4 can use LDAP queries, `net group "Domain Admins" /domain` and `net user /domain` for discovery.[2][5] |
| Enterprise | T1021 | Remote Services | Brute Ratel C4 has the ability to use RPC for lateral movement.[2] |
| Enterprise | T1620 | Reflective Code Loading | Brute Ratel C4 has used reflective loading to execute malicious DLLs.[3] |
| Enterprise | T1046 | Network Service Discovery | Brute Ratel C4 can conduct port scanning against targeted systems.[2] |
| Enterprise | T1482 | Domain Trust Discovery | Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.[2][5] |
| Enterprise | T1106 | Native API | Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.[2][3] |
| Enterprise | T1102 | Web Service | Brute Ratel C4 can use legitimate websites for external C2 channels including Slack, Discord, and MS Teams.[2] |
| Enterprise | T1071.004 | DNSSub-technique | Brute Ratel C4 can use DNS over HTTPS for C2.[2][5] |
| Enterprise | T1095 | Non-Application Layer Protocol | Brute Ratel C4 has the ability to use TCP for external C2.[2] |
| Enterprise | T1105 | Ingress Tool Transfer | Brute Ratel C4 can download files to compromised hosts.[2]CitationRapid7 Fake W2 July 2024 |
| Enterprise | T1027.007 | Dynamic API ResolutionSub-technique | Brute Ratel C4 can call and dynamically resolve hashed APIs.[2] |
| Enterprise | T1497.003 | Time Based ChecksSub-technique | Brute Ratel C4 can call `NtDelayExecution` to pause execution.[2][3] |
| Enterprise | T1574.001 | DLLSub-technique | Brute Ratel C4 has used search order hijacking to load a malicious payload DLL as a dependency to a benign application packaged in the same ISO.[2] Brute Ratel C4 has loaded a malicious DLL by spoofing the name of the legitimate Version.DLL and placing it in the same folder as the digitally-signed Microsoft binary OneDriveUpdater.exe.[2] |
| Enterprise | T1558.003 | KerberoastingSub-technique | Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.[2] |
| Enterprise | T1204.002 | Malicious FileSub-technique | Brute Ratel C4 has gained execution through users opening malicious documents.[2] |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | Brute Ratel C4 can use HTTPS and HTTPS for C2 communication.[2][5] |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(3)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.1 | Older bundle | 298aa28db36c… | ||
| 19.2 | 1.1 | Current bundle | 298aa28db36c… | ||
| 19.1 | 1.1 | Older bundle | 298aa28db36c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Dark Vortex Brute Ratel C4
Dark Vortex. (n.d.). A Customized Command and Control Center for Red Team and Adversary Simulation. Retrieved February 7, 2023.
Open source URL - [2]Palo Alto Brute Ratel July 2022
Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.
Open source URL - [3]MDSec Brute Ratel August 2022
Chell, D. PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023.
Open source URL - [4]SANS Brute Ratel October 2022
Thomas, W. (2022, October 5). Cracked Brute Ratel C4 framework proliferates across the cybercriminal underground. Retrieved February 6, 2023.
Open source URL - [5]Trend Micro Black Basta October 2022
Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.
Open source URL - [6]BRc4
(Citation: Palo Alto Brute Ratel July 2022)
- [7]mitre-attackS1063Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.