Warzone RAT infrastructure seized

On February 9, 2024, the Justice Department announced that an international operation had seized internet domains that were selling information-stealing malware. Federal authorities in Boston seized and three related domains, which sold the Warzone RAT malware.

The Warzone RAT malware, a sophisticated Remote Access Trojan (RAT), enabled cybercriminals to browse victims’ file systems, take screenshots, record keystrokes, steal victims’ usernames and passwords, and watch victims through their web cameras, all without their knowledge or permission.

On February 7, 2024, two suspects were arrested in Malta and Nigeria, accused of selling the malware and supporting cybercriminals who used it for malicious purposes.

The operation was led by the FBI, and supported by Europol and the Joint Cybercrime Action Taskforce (J-CAT).

Anyone who is a victim of a Warzone RAT computer intrusion is urged to report it to the FBI via its Warzone RAT Victim Reporting Form.

Signs of infection

There are some know Indicators of Compromise (IOCs) for recent versions of the Warzone RAT (aka AveMaria Stealer):

SHA 256 hashes:








Warzone RAT is usually spread by emails that use social engineering methods to trick the receiver into downloading and triggering the infection.

General signs that a RAT is active on your system may be:

  • A slow computer and seemingly slow internet connection.
  • Unknown processes in Task Manager.
  • Missing or altered files on your system.
  • Unknown entries in the list of installed programs/software.


To keep RATs off your systems, the most general rules of security apply:

  • Keep your software and internet connected devices updated.
  • Only download apps and other software from trusted sources.
  • Be careful about which sites you visit and which emails you open.
  • Never open unsolicited email attachments.
  • Use an up-to-date anti-malware solution.

Malwarebytes and ThreatDown products will detect the Warzone RAT as:

  • Trojan.MalPack.PNG.Generic
  • Trojan.MalPack.MSIL.Generic
  • Generic.Malware.AI.DDS
  • Malware.AI.2990474738
  • Trojan.MalPack

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.