Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S1065
MITRE ATT&CK Malware

Woody RAT (S1065)

ShareXLinkedInRedditHN

[Woody RAT](https://attack.mitre.org/software/S1065) is a remote access trojan (RAT) that has been used since at least August 2021 against Russian organizations.(Citation: MalwareBytes WoodyRAT Aug 2022)

Platforms: Windows

▪Techniques implemented (30)

T1083File and Directory DiscoveryT1033System Owner/User DiscoveryT1059.003Windows Command ShellT1055.012Process HollowingT1082System Information DiscoveryT1059.001PowerShellT1041Exfiltration Over C2 ChannelT1057Process DiscoveryT1027.013Encrypted/Encoded FileT1680Local Storage DiscoveryT1518.001Security Software DiscoveryT1087Account DiscoveryT1005Data from Local SystemT1113Screen CaptureT1140Deobfuscate/Decode Files or InformationT1105Ingress Tool TransferT1573.002Asymmetric CryptographyT1070.004File DeletionT1055Process InjectionT1071.001Web ProtocolsT1566.001Spearphishing AttachmentT1016.001Internet Connection DiscoveryT1204.002Malicious FileT1106Native APIT1685Disable or Modify ToolsT1016System Network Configuration DiscoveryT1203Exploitation for Client ExecutionT1012Query RegistryT1518Software DiscoveryT1573.001Symmetric Cryptography
S1065 on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.