WarzoneRAT

WarZone RAT, also known as AveMaria, is a commodity remote access trojan created in 2018 and widely used in cybercrime. It has been described as enabling remote access to targeted organizations’ systems and has a long history of criminal use. Reported capabilities in the provided content include hidden remote desktop access via hVNC, control of an infected PC using RDP, webcam access, keylogging-related behavior, credential theft including passwords from numerous web browsers as well as Outlook and Thunderbird, cookie and password stealing, remote shell access, reverse proxying, file operations, process management, and exfiltration of collected victim data to its command-and-control server. The malware can use PowerShell to download files and execute commands, inject malicious DLLs into specific processes for privilege escalation, create the registry key HKCU\Software\Classes\Folder\shell\open\command during privilege escalation, and disarm Windows Defender during the UAC process to evade detection. The content also notes overlap in behavioral traces with other RATs such as njRAT, NanoCore, and NetWire, particularly around process injection, keylogging-related calls, and C2 traffic. Infection has been associated with malicious email attachments that require the victim to open the attachment for execution. The malware has also been referenced in Scattered Spider activity, where phishing attacks were used to install WarZone RAT alongside other stealers to obtain credentials, cookies, and other useful data. A 2024 FBI-led law enforcement action dismantled infrastructure associated with the malware’s operation, seized domains including warzone.ws, and arrested individuals allegedly involved in its proliferation and customer support.