MALWARE FAMILY

Orcus RAT

Internal ID: win.orcus_rat

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.

Threat Analysis

Orcus RAT is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://researchcenter.paloaltonetworks.com/2016/08/unit42-orcus-birth-of-an-unusual-plugin-builder-rat/

→https://any.run/cybersecurity-blog/orcus-rat-malware-analysis/

→https://asec.ahnlab.com/en/45462/

→https://assets.virustotal.com/reports/2021trends.pdf

→https://blog.checkpoint.com/2019/02/27/protecting-against-winrar-vulnerabilities/

→https://blog.fortinet.com/2017/12/07/a-peculiar-case-of-orcus-rat-targeting-bitcoin-investors

→https://blog.talosintelligence.com/2019/08/rat-ratatouille-revrat-orcus.html

→https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord

→https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/

→https://krebsonsecurity.com/2019/04/canadian-police-raid-orcus-rat-author/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.orcus_rat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Orcus RAT