RDAT — Malware Profile

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.

MITRE ATT&CK techniques (20)

• T1001 Data Obfuscation
• T1001.002 Steganography
• T1008 Fallback Channels
• T1027.003 Steganography
• T1030 Data Transfer Size Limits
• T1036.004 Masquerade Task or Service
• T1036.005 Match Legitimate Resource Name or Location
• T1041 Exfiltration Over C2 Channel
• T1059.003 Windows Command Shell
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1071.003 Mail Protocols
• T1071.004 DNS
• T1105 Ingress Tool Transfer
• T1113 Screen Capture
• T1132.001 Standard Encoding
• T1132.002 Non-Standard Encoding
• T1140 Deobfuscate/Decode Files or Information
• T1543.003 Windows Service
• T1573.001 Symmetric Cryptography

IntelFusions coverage

• OilRig's RDAT Backdoor Deploys Novel Steganographic Email C2 via Exchange Web Services: BMP-Hidden Commands Against Middle Eastern Telecom 2026-02-16

Attributed threat actors

• OilRig

Read the full analysis on IntelFusions