Malware
9002 RAT
- First Reported
- May 21, 2026
- Latest Reported
- May 23, 2026
Reported Context (3)
- ESET says the group has evolved its tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden ESET Details Webworm’s Shift to European Government Targets and New C2 Backdoors
- Attacks mounted by the group have leveraged remote access trojans (RATs) like Trochilus RAT, Gh0st RAT, and 9002 RAT (aka Hydraq and McRat). Webworm Adds EchoCreep and GraphWorm Backdoors Using Discord and Microsoft Graph API
- In the past, it made use of well-known malware families such as McRat (aka 9002 RAT) and Trochilus, though in recent years, it has started moving toward both existing and custom proxy tools, which are more stealthy than ESET Details Webworm’s New Discord and Microsoft Graph Backdoors
CVE (1)
Malware (7)
People (2)
Threat Actors (6)
MITRE ATT&CK (17)
Vendors (7)
Products (6)
Tools (10)
Industries (4)
Countries (14)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.