Canadian Man Behind Popular ‘Orcus RAT’
Summary: Krebs on Security identified John Revesz, a 33-year-old Toronto security guard and former TD Bank IT systems administrator, as the person behind the Orcus RAT sold under the nickname "Ciriis Mcgraw" and "Armada." Researchers Daniel Gallagher and others said Orcus includes a keylogger, a webcam viewer that disables the camera light, and plugins for spreading files via USB and hijacking ad traffic, while Revesz maintained the tool is a legitimate remote administration product whose EULA forbids misuse.
What you should know: Revesz also sells a $30-$150-per-year "bulletproof" dynamic DNS service that promises not to log customer activity or report to law enforcement, and Kaspersky and Heimdal writeups have tied his service to Adwind botnet activity - a reminder that takedown and attribution efforts can be undone by infrastructure built specifically to outlast them.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026