The Legend of Adwind: A Commodity RAT Saga in Eight Parts
Summary: A developer began selling the Java-based Frutas RAT in early 2012, and the malware was rebranded at least seven times under names including Adwind, UnReCoM, Alien Spy, JSocket, JBifrost, UnknownRat, and JConnectPro. Palo Alto Networks collected over 45,000 samples of the Adwind family and observed them in more than 2 million attacks against its customers since 2017.
What's compelling: Unit 42 traced every rebrand back to the same author, showing that the apparent changes of ownership never happened - so a name change is not evidence that a threat has changed hands or gone away. More than 2 million attacks against one vendor's customers since 2017 is the scale a single commodity RAT reached while repeatedly renaming itself.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026