New Borat RAT Combines Ransomware and DDoS Capabilities

blog.cyble.com

New Borat RAT Combines Ransomware and DDoS Capabilities

First seen 1 Oct 2026, 16:02 UTC • •54.1

Article Content

1 / 3

Browse articles

ThreatCluster •October 1, 2026 at 17:05 UTC

•Borat RAT combines traditional RAT features with ransomware and DDoS capabilities.
•The Trojan can disable security software and steal sensitive user data.
•Cyble recommends enhanced security practices to mitigate risks from Borat.

A new Remote Access Trojan (RAT) named Borat has been identified, allowing attackers to control compromised systems and launch ransomware and DDoS attacks. Developed by an unknown creator, Borat can disable security features, record keystrokes, and steal sensitive data. It also includes a dashboard for executing DDoS attacks and deploying ransomware payloads. Cyble, the firm that reported on Borat, warns that this RAT represents a significant threat due to its multi-faceted capabilities. Organizations and individuals are advised to enhance their security measures to protect against this emerging threat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-01

Borat RAT identified

Cyble reported the discovery of the Borat RAT, detailing its capabilities including ransomware and DDoS attacks.

2026-10-01

Cyble's report published

Cyble published a detailed analysis of the Borat RAT, outlining its features and potential risks.

More articles in this cluster (2)

Threat Graph

9 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (6)

DDoS
Malware
Ransomware
Trojan
T1056 - Input Capture
T1486 - Data Encrypted for Impact

Malware (2)

Borat
Borat RAT

Affected Platform (1)

Windows

Relationships

DDoS targets Windows
Malware targets Windows
Ransomware targets Windows
Trojan targets Windows
T1056 - Input Capture targets Windows
T1486 - Data Encrypted for Impact targets Windows
Borat related to Borat RAT

Following this threat?

Track Borat in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

What capabilities does Borat RAT have?

Borat RAT can disable security software, log keystrokes, steal data, and launch ransomware and DDoS attacks.

Who is affected by Borat RAT?

Any users or organizations that have their systems compromised by Borat RAT are at risk.

What should organizations do to protect against Borat RAT?

Organizations should implement strong passwords, multi-factor authentication, and keep their systems updated.

Continue Reading

Critical Zero-Day Exploits Target F5 and Check Point Products F5 Networks released emergency hotfixes for a critical zero-day vulnerability, CVE-2026-94127, in its BIG-IP Access Policy Manager on September 22, 2026, after confirming active exploitation. This flaw allows unauthenticated remote code execution (RCE) and has a CVSS score of 9.8. Concurrently, Check Point disclosed…

Critical Citrix NetScaler Zero-Day Vulnerabilities Exploited Citrix disclosed two critical zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway systems, which are being actively exploited. Both vulnerabilities have a CVSS score of 9.5 and allow unauthenticated attackers to execute arbitrary commands remotely. CVE-2026-88771 arises…