HOMETHREATSPowerRatankba
APT / THREAT GROUP

PowerRatankba

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

QUICKRIDE.POWER is a PowerShell variant of the QUICKRIDE backdoor. Its payloads are often saved to C:\windows\temp\

Threat Analysis

PowerRatankba is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf
→https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/
→https://content.fireeye.com/apt/rpt-apt38
→https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf
→https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

QUICKRIDE.POWERPowerRatankbawin.power_ratankba

External Intelligence

Malpedia: win.power_ratankba

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search PowerRatankba