{"schema":"aeternae-malware-metadata/v1","generated_at":"2026-10-08T09:16:53+00:00","total_matching":1,"page":1,"page_size":200,"records":[{"id":"74f1e0660b1a68eedced746ccddacaa90e9061a35fcda15954a02719e2844873","kind":"reference","title":"WarzoneRAT - S0670","family":"WarzoneRAT - S0670","category":"Malware intelligence","summary":"Name of ATT&CK software | [WarzoneRAT](https://attack.mitre.org/software/S0670) is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)","first_seen":1671535541,"last_seen":1678791070,"created_at":1791434072,"updated_at":1791434167,"source_count":1,"data":{"context":"2023/03/YoroTrooper.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"WarzoneRAT - S0670\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json","https://github.com/Cisco-Talos/IOCs/blob/main/2023/03/YoroTrooper.json"],"filenames":[],"features":[],"related_cves":[],"labels":["WarzoneRAT - S0670"]},"observations":[{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json","source_label":"WarzoneRAT - S0670","evidence_class":"provider_reported","confidence":null,"observed_at":1671535541,"fetched_at":1791434072,"data":{"context":"2022/12/xlling-in-excel-malicious-add-ins.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"WarzoneRAT - S0670\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2022/12/xlling-in-excel-malicious-add-ins.json"],"family":"WarzoneRAT - S0670"}},{"source_id":"talos_ioc","source_url":"https://github.com/Cisco-Talos/IOCs/blob/main/2023/03/YoroTrooper.json","source_label":"WarzoneRAT - S0670","evidence_class":"provider_reported","confidence":null,"observed_at":1678791070,"fetched_at":1791434167,"data":{"context":"2023/03/YoroTrooper.json","tags":["misp:galaxy-name=\"Malware\"","misp:galaxy-type=\"mitre-malware\"","misp-galaxy:mitre-malware=\"WarzoneRAT - S0670\""],"aliases":[],"references":["https://github.com/Cisco-Talos/IOCs/blob/main/2023/03/YoroTrooper.json"],"family":"WarzoneRAT - S0670"}}],"indicators":[]}]}