APT / THREAT GROUP

Sakula RAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Sakula / Sakurel is a trojan horse that opens a back door and downloads potentially malicious files onto the compromised computer.

Threat Analysis

Sakula RAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cyberthreatintelligenceblog.wordpress.com/2018/11/16/c0ld-case-from-aerospace-to-chinas-interests/

→https://docs.broadcom.com/doc/the-black-vine-cyberespionage-group

→https://github.com/nccgroup/Cyber-Defence/tree/master/Technical%20Notes/Sakula

→https://web.archive.org/web/20151001235506/https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=654

→https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Sakurelwin.sakula_ratSakula RAT

External Intelligence

Malpedia: win.sakula_rat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Sakula RAT