threat actor · Origin not attributed
RapperBot
1 CVE exploited
The strips, in order: the CVEs it is reported to exploit by weakness class and by vendor, the techniques ATT&CK says it uses by tactic, its malware and tools, then who it targets. Each square is one record.
Open RapperBot's actor pageRapperBot is named in one CyberSIXT article, which reports on botnets exploiting a KGUARD DVR flaw. Netlab 360 is cited as attributing CVE-2026-87827 to the activity, but the record does not establish that RapperBot itself exploited it; little is on record.
Source: CyberSIXT summary, 14 November 2026. Written by CyberSIXT's model from CyberSIXT's own article summaries and records, and checked against them; read the articles before relying on it.
- Origin
- Not attributed
- On record in
- CyberSIXT
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.