Data by Hatching Triage Windows

VectraRAT

VectraRAT is a Windows-focused, rental-only malware-as-a-service remote-access trojan operated by a developer known as Vectra, reportedly formerly Nyxel.

Profile source: Mallory

VectraRAT

Family profile

VectraRAT is a Windows-focused, rental-only malware-as-a-service remote-access trojan operated by a developer known as Vectra, reportedly formerly Nyxel. The platform comprises a Windows implant, a Linux-based control server, an operator panel, and a payload builder. It provides covert remote control through a hidden virtual desktop, screen capture, remote Command Prompt and PowerShell execution, file transfer, process discovery, keylogging, and SOCKS5 proxying through compromised hosts. Its automated collection component gathers browser credentials, network and system information, and configuration files that can contain sensitive application secrets. VectraRAT can also manipulate clipboard contents to hijack cryptocurrency payment addresses and supports privilege escalation without a user prompt through abuse of trusted Windows auto-elevation functionality. The implant uses a custom TCP command-and-control protocol and can be redirected to new control infrastructure after deployment. Observed distribution included Amadey-mediated deployment and ClickFix social-engineering pages, including tax-themed lures that induced victims to execute attacker-supplied commands. Activity has affected corporate Windows environments, including Enterprise and Windows Server systems, and has included theft of files from business systems.

Capabilities

Credential Theft
Crypto Theft
Defense Evasion
Exfiltration
Keylogging
Post Exploitation
Privilege Escalation
Reconnaissance

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Sep 15

Observed infrastructure

Last seven days

First activity: Sep 15, 2026
Last activity: Sep 15, 2026
Feed role: C2
Host form: 3 IP / 0 hostnames

Leading locations

Leading providers

ServerAstra Kft.2
Omegatech LTD1

Infrastructure traits

Hosting 3

Reported operators

Threat actors

2 named in public reporting

Nyxel

VectraRAT is a rental-only Malware-as-a-Service platform that gives a paying operator full remote control of a Windows host, along with automated credential and file collection on first connection.

Vectra

VectraRAT is a rental-only Malware-as-a-Service platform that gives a paying operator full remote control of a Windows host, along with automated credential and file collection on first connection.

MITRE ATT&CK

VectraRAT in ATT&CK

32 distinct techniques

Techniques

32 techniques

T1548.002 Bypass User Account Control T1090 Proxy T1571 Non-Standard Port T1059.001 PowerShell T1095 Non-Application Layer Protocol T1204.004 Malicious Copy and Paste T1059.003 Windows Command Shell T1016 System Network Configuration Discovery T1059 Command and Scripting Interpreter T1219 Remote Access Tools T1056.001 Keylogging T1552.001 Credentials In Files T1555.003 Credentials from Web Browsers T1204.002 Malicious File T1106 Native API T1113 Screen Capture T1140 Deobfuscate/Decode Files or Information T1134.004 Parent PID Spoofing T1036.005 Match Legitimate Resource Name or Location T1082 System Information Discovery T1036.001 Invalid Code Signature T1057 Process Discovery T1568 Dynamic Resolution T1204.001 Malicious Link T1090.001 Internal Proxy T1049 System Network Connections Discovery T1115 Clipboard Data T1119 Automated Collection T1566.002 Spearphishing Link T1005 Data from Local System T1041 Exfiltration Over C2 Channel T1105 Ingress Tool Transfer

Reporting

Research mentioning VectraRAT

Sep 16

Cyber Security News

Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs

Researchers uncovered VectraRAT, a previously undocumented Windows remote-access trojan sold exclusively as a malware-as-a-service subscription for $250 per month. Operated by a developer using the aliases Vectra and formerly Nyxel, the full-stack platform enables surveillance, credential theft, remote command execution, file transfer, proxying, and privilege escalation on compromised systems. SOCRadar discovered the operation through an exposed directory containing malware samples, server-side components, licenses, and operator logs, then identified more than 10 related servers. Operators delivered VectraRAT through Amadey loader campaigns and ClickFix pages impersonating TurboTax that prompt victims to paste commands into the Windows Run dialog; logs showed 38 genuine sessions in less than a week, with corporate Windows editions—including Enterprise and Windows Server 2025—accounting for 48% of records containing operating-system data.

Sep 16

Cryptika