BruteRatel C4
Brute Ratel C4 (BRc4) is an adversary simulation and red-teaming framework designed to evade modern security defenses. Although it is a legitimate offensive security tool, the provided reporting states that threat actors have abused it for post-exploitation and command-and-control operations. Microsoft reported tax-themed phishing campaigns observed in early 2025 that attempted to deliver BRc4 and Latrodectus to U.S. targets. In one campaign attributed to the initial access broker Storm-0249, IRS-themed phishing emails used PDF attachments and redirect chains leading to a fake DocuSign page; if filtering conditions were met, a Firebase-hosted JavaScript downloaded an MSI containing BRc4, which then installed Latrodectus. The broader campaigns targeted U.S. users and organizations, including sectors such as engineering, IT, and consulting, and used infrastructure associated with RaccoonO365 phishing-as-a-service. The content also explicitly notes that MalwareBazaar incorrectly classified sample fb91de5a3ce80ac51fded1719dc72c6c71acadc65ada3262e7bc74dac41cd65a as BruteRatel C4; according to the cited analysis, that sample was actually a Delphi self-extracting installer deploying weaponized NQVM/NetSupport Manager tooling, not BRc4.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earlier this April, the Redmond-based company warned of several phishing campaigns leveraging tax-related themes to deploy malware such as Latrodectus, AHKBot, GuLoader, and BruteRatel C4 (BRc4). The phishing pages, it added, were delivered via RaccoonO365, with one such campaign attributed to an initial access broker called Storm-0249.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as an incorrect classification for the sample; the content explicitly states the sample is not BruteRatel C4.
Post-exploitation tool deployed via phishing campaigns delivered through RaccoonO365.
Commercial/legitimate red-teaming framework abused by threat actors for post-exploitation and command-and-control; designed to evade/bypass modern defenses.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.