APT / THREAT GROUP

Orcus RAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.

Threat Analysis

Orcus RAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://researchcenter.paloaltonetworks.com/2016/08/unit42-orcus-birth-of-an-unusual-plugin-builder-rat/

→https://any.run/cybersecurity-blog/orcus-rat-malware-analysis/

→https://asec.ahnlab.com/en/45462/

→https://assets.virustotal.com/reports/2021trends.pdf

→https://blog.checkpoint.com/2019/02/27/protecting-against-winrar-vulnerabilities/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Schnorchelwin.orcus_ratOrcus RAT

External Intelligence

Malpedia: win.orcus_rat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Orcus RAT