Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0670
MITRE ATT&CK Malware

WarzoneRAT (S0670)

WarzoneAve Maria
ShareXLinkedInRedditHN

[WarzoneRAT](https://attack.mitre.org/software/S0670) is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)

Platforms: Windows

▪Techniques implemented (30)

T1057Process DiscoveryT1056.001KeyloggingT1547.001Registry Run Keys / Startup FolderT1204.002Malicious FileT1685Disable or Modify ToolsT1041Exfiltration Over C2 ChannelT1555.003Credentials from Web BrowsersT1548.002Bypass User Account ControlT1005Data from Local SystemT1105Ingress Tool TransferT1082System Information DiscoveryT1090ProxyT1573.001Symmetric CryptographyT1021.001Remote Desktop ProtocolT1112Modify RegistryT1546.015Component Object Model HijackingT1564Hide ArtifactsT1566.001Spearphishing AttachmentT1140Deobfuscate/Decode Files or InformationT1059.001PowerShellT1106Native APIT1125Video CaptureT1564.003Hidden WindowT1055Process InjectionT1059.003Windows Command ShellT1021.005VNCT1221Template InjectionT1095Non-Application Layer ProtocolT1083File and Directory DiscoveryT1014Rootkit

▪Used by groups (3)

G1018TA2541G1015Scattered SpiderG0142Confucius
S0670on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.