NETWIRE

NetWire is a remote access trojan (RAT) and credential-stealing malware family. The provided content associates it with process injection, keylogging-related behavior, command-and-control traffic, automated data collection, credential theft, persistence, and delivery through phishing and malware downloaders. NetWire has been observed stealing passwords from messaging and mail client applications and from web browsers including Internet Explorer, Opera, Yandex, and Chrome. It can automatically archive collected data, write collected data to files in a ./LOGS directory, copy itself to and execute from hidden folders, and inject code into processes including notepad.exe, svchost.exe, and vbc.exe. The content also notes registry-based persistence via HKCU\SOFTWARE\NetWire and an autorun entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, as well as macOS persistence through LaunchAgents. Execution and delivery vectors mentioned include spearphishing and email campaigns with malicious attachments or documents, PowerShell-based execution, and distribution by GuLoader. NetWire is described as cross-platform in at least one context, and Bahamut is specifically noted as using the publicly available cross-platform RAT NETWIRE alongside Revenge RAT. Threat actors and clusters explicitly associated with NetWire in the content include ModifiedElephant, which used NetWire and DarkComet against human rights activists, academics, journalists, and lawyers in India; TA2541, which has used NetWire in campaigns targeting aviation, aerospace, transportation, manufacturing, and defense organizations; Bahamut; and Nigerian BEC actors tracked as SilverTerrier. The content also notes behavioral overlap between NetWire and other commodity RATs such as WarZoneRAT, njRAT, and NanoCore due to similarities in injection, keylogging-related calls, and C2 traffic.