Who’s Behind the Net Wire Remote Access Trojan?
Summary: A Croatian national was arrested for allegedly operating NetWire, a Remote Access Trojan sold openly since 2012 for $80-$140 that targets Windows, Android, Linux and Mac systems and consistently ranks among the top 10 most active RATs. The arrest coincided with the FBI's seizure of the NetWire sales website, and Swiss law enforcement seized the server hosting the RAT infrastructure; the defendant has not been publicly named, though Krebs traces the operation to a Mario Zanko of Zapresic, Croatia through DNS records, shared email addresses and a reused password.
Bottom line: NetWire ran in plain sight for 11 years at a fixed price and stayed in the top 10 most active RATs, typically delivered through booby-trapped Office documents - and the trail that tied it to an operator was built from DNS records, leaked credentials and a Skype handle, not from the malware itself.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026