RatonRAT
8 hosts convicted as RatonRAT remote-access trojan controllers: 8 still listed, 0 archived. First seen 2026-08-28.
About
A Windows commodity remote-access trojan, whose samples IOC aggregators have tracked as RatonRAT since February 2026 and whose listeners they have listed since March. In name and design it matches Raton Access Tool, or SillyRAT, an open-source C# RAT that vendor reporting describes being run as a paid service — a correspondence no vendor has stated outright. The listeners recorded here presented self-signed certificates cut from one distinctive template, each on a different port — the shape of a product default deployed unchanged.
Ports
Detection packs
Rules for this hub's 8 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.