RATicate
RATicate is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Manufacturing and Telecommunications, in 6 countries, including the United Kingdom and Japan.
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2019
- Record updated
Who They Target.
About RATicate.
In a series of malspam campaigns dating back to November of 2019, an unidentified group sent out waves of installers that drop remote administration tool (RAT) and information stealing malware on victims’ computers. We’ve identified five separate campaigns between November, 2019 and January, 2020 in which the payloads used similar packing code and pointed to the same command and control (C&C) infrastructure. The campaigns targeted industrial companies in Europe, the Middle East, and the Republic of Korea. This leads us to believe that they are all the work of the same actors, a group we’ve dubbed RATicate. A new campaign we believe connected to the same actors leverages concern about the global COVID-19 pandemic to convince victims to open the payloads. This is a shift in tactics, but we suspect that this group constantly changes the way they deploy malware, and that the group has conducted campaigns prior to this past November.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.