Malware
CNCMachineRMS
- First Reported
- Aug 10, 2026
- Latest Reported
- Oct 23, 2026
Reported Context (3)
- Payload: the BabaDeda loader, which unpacks the CNCMachineRMS RAT (v1.6.6). Analysis Finds Fake Teams MSI Hiding BabaDeda Loader and CNCMachineRMS RAT
- New stealers and RATs, including Phantom Stealer, Vanta Stealer, Salat Stealer, and CNCMachineRMS, targeted credentials and remote access. ThreatsDay Roundup: 296,000-Device IoT Botnet, 100+ Water Systems Targeted, SharePoint Flaws Probed
- A loader chain starting from a ClickFix lure abuses signed IBM SPSS IDE, decoy DLLs, and EnumTimeFormatsEx to deliver the BabaDeda stage and the CNCMachineRMS remote administration implant. Research Uncovers CNCMachineRMS RAT at End of BabaDeda Loader Chain
CVE (2)
Malware (10)
People (2)
Threat Actors (3)
MITRE ATT&CK (28)
Vendors (3)
Products (8)
Tools (8)
Industries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.