APT / THREAT GROUP

BlackNET RAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Advanced and modern Windows botnet with PHP panel developed using VB.NET. It has a lot of functionalities including: stealing/grabbing files and passwords, keylogging, cryptojacking, loading files, executing commands, etc. It is open source and emerged at the end of 2019.

Threat Analysis

BlackNET RAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.pwncode.io/2019/12/blacknet-rat-when-you-leave-panel.html

→https://blog.malwarebytes.com/threat-analysis/2020/03/fake-corona-antivirus-distributes-blacknet-remote-administration-tool/

→https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware

→https://github.com/BlackHacker511/BlackNET/

→https://github.com/FarisCode511/BlackNET/

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

BlackNET RATwin.blacknet_rat

External Intelligence

Malpedia: win.blacknet_rat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search BlackNET RAT