Malware

Violet

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059.003Windows Command ShellEvidence1

Batch Downloaders Two batch scripts handle payload retrieval and execution: UKM031.bat (downloader) — Uses curl to pull from the fourth tunnel ... UKM032.bat (executor) — Runs the Python injectors, then cleans up

T1059.006PythonEvidence1

Stage 5: Python Shellcode Injectors ... All nine scripts use identical injection code ... CreateProcessA( "explorer.exe" , ..., CREATE_SUSPENDED) ... WriteProcessMemory ... QueueUserAPC(addr, hThread, 0 )

T1059.007JavaScriptEvidence1

The .wsf loader ( ukmar03.wsf , 666 bytes) copies two batch files from the third tunnel to %USERPROFILE%\Contacts\ , renames them from .txt to .bat , and executes them with a 90-second delay between stages.

T1204.002Malicious FileEvidence1

MITRE ATT&CK Mapping Technique ID Implementation User Execution: Malicious File T1204.002 .wsh masquerading as PDF

Persistence

2 techniques

T1112Modify RegistryEvidence1

Persistence Mechanisms The campaign implements layered persistence: ... Registry Run keys — Software\Microsoft\Windows\CurrentVersion\Run\ (AsyncRAT, DcRAT, Violet)

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence Mechanisms The campaign implements layered persistence: Startup folder batch scripts — launch Python injectors on boot from four different paths

Privilege Escalation

2 techniques

T1055.004Asynchronous Procedure CallEvidence1

addr = VirtualAllocEx(hProcess, ..., MEM_COMMIT|MEM_RESERVE, PAGE_EXECUTE_READWRITE) WriteProcessMemory(hProcess, addr, shellcode, len (shellcode)) QueueUserAPC(addr, hThread, 0 ) ResumeThread(hThread)

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence Mechanisms The campaign implements layered persistence: Startup folder batch scripts — launch Python injectors on boot from four different paths

Stealth

4 techniques

T1027.013Encrypted/Encoded FileEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Obfuscated Files: Encrypted/Encoded File T1027.013 AES-CBC + XOR + base64 layers

T1055.004Asynchronous Procedure CallEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

UKM032.bat ... Hides payload folders with attrib +h

T1620Reflective Code LoadingEvidence1

CLR hosting: Loads mscoree.dll to host .NET runtime, calls Assembly.Load() for fileless execution

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Persistence Mechanisms The campaign implements layered persistence: ... Registry Run keys — Software\Microsoft\Windows\CurrentVersion\Run\ (AsyncRAT, DcRAT, Violet)

Credential Access

1 technique

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Input Capture: Keylogging T1056.001 XWorm, Violet keyloggers

Collection

2 techniques

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Input Capture: Keylogging T1056.001 XWorm, Violet keyloggers

T1115Clipboard DataEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Clipboard Data T1115 Violet clipper

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Ingress Tool Transfer T1105 curl download of ZIP payloads

T1568.002Domain Generation AlgorithmsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Dynamic Resolution: DNS T1568.002 DuckDNS dynamic DNS for all C2

T1571Non-Standard PortEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Non-Standard Port T1571 C2 on ports 2120, 6745, 6757, 7878, 8292

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 6, 2026

Five RATs, One Tunnel: Dissecting a Multi-Family Malware Campaign Abusing Cloudflare and WsgiDAV - Breakglass Intelligence - Breakglass Intelligence

A RAT with additional criminal features including a cryptocurrency clipper, bot-killer, fake update screen, ngrok tunneling for RDP, credential theft, network discovery, HTTP DDoS capability, and persistence artifacts on disk.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Violet

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059.003Windows Command ShellEvidence1

T1059.006PythonEvidence1

T1059.007JavaScriptEvidence1

T1204.002Malicious FileEvidence1

MITRE ATT&CK Mapping Technique ID Implementation User Execution: Malicious File T1204.002 .wsh masquerading as PDF

Persistence

2 techniques

T1112Modify RegistryEvidence1

Persistence Mechanisms The campaign implements layered persistence: ... Registry Run keys — Software\Microsoft\Windows\CurrentVersion\Run\ (AsyncRAT, DcRAT, Violet)

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence Mechanisms The campaign implements layered persistence: Startup folder batch scripts — launch Python injectors on boot from four different paths

Privilege Escalation

2 techniques

T1055.004Asynchronous Procedure CallEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence Mechanisms The campaign implements layered persistence: Startup folder batch scripts — launch Python injectors on boot from four different paths

Stealth

4 techniques

T1027.013Encrypted/Encoded FileEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Obfuscated Files: Encrypted/Encoded File T1027.013 AES-CBC + XOR + base64 layers

T1055.004Asynchronous Procedure CallEvidence1

T1564.001Hidden Files and DirectoriesEvidence1

UKM032.bat ... Hides payload folders with attrib +h

T1620Reflective Code LoadingEvidence1

CLR hosting: Loads mscoree.dll to host .NET runtime, calls Assembly.Load() for fileless execution

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Persistence Mechanisms The campaign implements layered persistence: ... Registry Run keys — Software\Microsoft\Windows\CurrentVersion\Run\ (AsyncRAT, DcRAT, Violet)

Credential Access

1 technique

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Input Capture: Keylogging T1056.001 XWorm, Violet keyloggers

Collection

2 techniques

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Input Capture: Keylogging T1056.001 XWorm, Violet keyloggers

T1115Clipboard DataEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Clipboard Data T1115 Violet clipper

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Ingress Tool Transfer T1105 curl download of ZIP payloads

T1568.002Domain Generation AlgorithmsEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Dynamic Resolution: DNS T1568.002 DuckDNS dynamic DNS for all C2

T1571Non-Standard PortEvidence1

MITRE ATT&CK Mapping Technique ID Implementation ... Non-Standard Port T1571 C2 on ports 2120, 6745, 6757, 7878, 8292

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

10 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

breakglass intelNews

Mar 6, 2026

Five RATs, One Tunnel: Dissecting a Multi-Family Malware Campaign Abusing Cloudflare and WsgiDAV - Breakglass Intelligence - Breakglass Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.