Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Mr_Rot13

Mr_Rot13 is a threat actor group, tracked by Brandefense.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2020
Record updated

About Mr_Rot13.

Mr_Rot13 is a stable hacking group identified through a PHP backdoor and a Downloader domain linked to a C2 infrastructure active since 2020. They utilize the Rot13 algorithm for obfuscation and have demonstrated a low detection rate across security products, indicating advanced operational security. Their activities include exploiting CVE- to deliver malicious payloads and maintaining covert communication via Telegram. The group has shown a particular focus on WordPress as a target, with ongoing operations that suggest a sophisticated threat actor rather than opportunistic attackers.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.