Threat Intelligence observed significant activity from the Forbidden Hyena threat actor group in late 2025 into early 2026, unveiling a novel remote access trojan (RAT) named BlackReaperRAT and a modified version of the Blackout Locker ransomware, now rebranded as Milkyway. BlackReaperRAT is disseminated via RAR files containing a batch script (1.bat) designed to execute a malicious VBS script (1.vbs), which subsequently downloads the RAT and a misleading document to distract users. The BlackReaperRAT is implemented as an obfuscated VBS script that generates a unique BotID upon execution, storing it in the user’s application data directory. Persistence mechanisms are robustly built in; it utilizes registry modifications to create autorun entries to ensure it executes upon system startup and employs Windows Task Scheduler for additional persistence as it registers these tasks under the highest privileges.