TF-MAL-elf.zuo_rat

Description

ThreatFox malware family `elf.zuo_rat`. Printable name: ZuoRAT.

Indicators of Compromise (0)

No indicators of compromise on this threat.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Expert Roundtable — May 21, 2026 morning | Halil Öztürkci
  web:halilozturkci.com

  It's serious, but not Conti-level — the Conti leaks included full operational infrastructure, internal chats, affiliate payment systems across multiple malware families. This is a single malware family's construction toolkit. Russia and South Africa targeting The current data confirms India and Russia as active targets.

  2026-05-22 05:24 UTC
• Remediate malicious email delivered in Office 365
  web:learn.microsoft.com

  Remediation means to take a prescribed action against a threat. Malicious email sent to your organization can be cleaned up by the system, through zero-hour auto purge (ZAP), or by security teams through remediation actions like move to inbox, move to junk, move to deleted items, soft delete, or hard delete. Microsoft Defender for Office 365 Plan 2 (included in Microsoft 365 A5/E5/E5) enables ...

  2026-05-22 05:24 UTC
• ZuoRAT (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  According to Black Lotus Labs, ZuoRAT is a MIPS file compiled for SOHO routers that can enumerate a host and internal LAN, capture packets being transmitted over the infected device and perform person-in-the-middle attacks (DNS and HTTPS hijacking based on predefined rules).

  2026-05-22 05:24 UTC
• Malware Incident Response: The 7-Step Playbook for 2025 - Breachsense
  web:www.breachsense.com

  Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.

  2026-05-22 05:24 UTC
• ZuoRAT Malware - Check Point Software
  web:www.checkpoint.com

  Learn what the ZuoRAT malware is, and what are some security best practices that can help organizations to protect against these attacks.

  2026-05-22 05:24 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:24 UTC
• ZuoRAT is a sophisticated malware that mainly targets SOHO routers
  web:www.malwarebytes.com

  The so-called ZuoRAT campaign, which very likely started in 2020, is so sophisticated that the researchers suspect that there is a state sponsored threat actor behind it. SOHO routers SOHO is short for small office/home office and SOHO routers are hardware devices that route data from a local area network (LAN) to another network connection.

  2026-05-22 05:24 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  This guidance helps private and public sector organisations deal with the effects of malware (which includes ransomware). It provides actions to help organisations prevent a malware infection, and also steps to take if you're already infected. Following this guidance will reduce: the likelihood of becoming infected the spread of malware throughout your organisation the impact of the infection

  2026-05-22 05:24 UTC
• What is ZuoRAT Malware? - Packetlabs
  web:www.packetlabs.net

  ZuoRAT is a new malware designed to attack small office/home office routers. This malware is particularly dangerous because it can allow attackers to gain access to the devices on the LAN, as well as any data that is passing through the router. What is ZuoRAT malware ?

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.