NarwhalRAT – Python-Based Remote Access Trojan by ScarCruft
June 25, 2026
NarwhalRAT is a Python-based remote access trojan (RAT) used by the North Korean group ScarCruft. It is capable of keylogging, screen capture, audio recording, file exfiltration, and C2 communication via Korean websites and pCloud API. It uses a hidden directory named '%APPDATA%naverwhale' to evade detection.