Say “Cheese”: Web Monitor RAT Comes with C2-as-a-Service (C2aaS)
Summary: Unit 42 documented WebMonitor, a commodity remote access trojan sold on HackForums since May 2017 by a seller named Revcode for €14.99 to €29.99, written in Visual Basic 6 and packed with UPX. The RAT uses a C2-as-a-Service model where customers cannot run their own command-and-control, instead connecting to customer-specific virtual hostnames under two root domains, revcode[.]eu and wm01[.]to.
Key Takeaway: Palo Alto Networks observed over 2,000 WebMonitor infection attempts against its own customers across multiple verticals worldwide, despite passive DNS showing just under 100 virtual hosts and roughly 500 distinct samples collected - a modest customer base producing outsized reach.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026