Netskope Threat Labs

MagicRAT

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Stats

First seen
September 2022
Last seen
October 2026

MITRE ATT&CK techniques

13 techniques across 6 tactics.

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0007 Discovery

  • T1016System Network Configuration Discovery
  • T1082System Information Discovery

TA0011 Command and Control

TA0010 Exfiltration

  • T1041Exfiltration Over C2 Channel

Associated groups

Alert name variants

Alert Name
Trojan.MagicRAT.A
Trojan.MagicRAT.B
Trojan.MagicRAT.C
Trojan.MagicRAT.D
Trojan.MagicRAT.E
Win32.Backdoor.MagicRAT
Win64.Backdoor.MagicRAT

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Backdoor.MagicRAT variant outbound connection

Related families

PlugXLatrodectusBazarBisonalQakBot