Rifdoor is a remote access trojan (RAT) that shares numerous code similarities with HotCroissant. - <https://attack.mitre.org/software/S0433/>

Rising Sun is a modular backdoor that was used extensively in Operation Sharpshooter between 2017 and 2019. Rising Sun infected at least 87 organizations around the world, including nuclear, defense, energy, and financial service companies. Security researchers assessed Rising Sun included some source code from Lazarus Group's Trojan Duuzer. - <https://attack.mitre.org/software/S0448/>

ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021. - <https://attack.mitre.org/software/S0240/>