HOMETHREATSRAILSETTER
APT / THREAT GROUP

RAILSETTER

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

According to Trend Micro, RAILSETTER is a persistence installer component designed to work with RAILLOAD. Its main functions include: Copying and renaming RAILLOAD’s intended host from System32 to the intended target directory; Timestomping RAILLOAD and its host’s create, access, and modify time; Creating a scheduled task for persistence.

Threat Analysis

RAILSETTER is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://www.trendmicro.com/en_us/research/25/c/the-espionage-toolkit-of-earth-alux.html

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

RAILSETTERwin.railsetter

External Intelligence

Malpedia: win.railsetter

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search RAILSETTER