HOMETHREATSMurofet
APT / THREAT GROUP

Murofet

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to bin.re, Murofet, also called LICAT, is a member of the ZeuS family. It uses a Domain Generation Algorithm (DGA) to determine the current C2 domain names.

Threat Analysis

Murofet is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://bin.re/blog/three-variants-of-murofets-dga/
→https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf
→https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-008.pdf
→https://www.secureworks.com/research/evolution-of-the-gold-evergreen-threat-group
→https://www.wired.com/2017/03/russian-hacker-spy-botnet/

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

win.murofetMurofetLicat

External Intelligence

Malpedia: win.murofet

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Murofet