His Name Is Anusfragger: We Wrote a Song About It Before Zscaler Named It
The Rebrand
Today Zscaler ThreatLabz announced their discovery of "NodeCordRAT."
His name is Anusfragger. We wrote a punk rock song about him.
The Receipts
Our Song (December 2025)
Track: "Rhyme of the Anusfragger"
Platform: Suno AI
Artist: @hacksawduggan
UUID: 3212b1c1-7430-4a6f-a67f-0a7189ff3dfc
URL: https://suno.com/song/3212b1c1-7430-4a6f-a67f-0a7189ff3dfc
Timestamped. Immutable. On a third-party platform we don't control.
Zscaler's "Discovery" (January 2026)
Name: "NodeCordRAT"
Announcement: January 7, 2026
Innovation: Giving our malware a boardroom-safe name
Why "Anusfragger"?
Because that's what it does. It frags your anus. Specifically:
- Browser credentials - fragged
- Crypto wallets - fragged
- Discord tokens - fragged
- API secrets - fragged
- SSH keys - fragged
"NodeCordRAT" sounds like enterprise software. "Anusfragger" sounds like what happens to your security posture when you run untrusted NPM packages.
Which name do you think developers will remember?
The Full Catalog
We didn't just document this threat family. We made an album.
| Track | Investigation | UUID |
| Rhyme of the Anusfragger | Origin story | 3212b1c1-7430-4a6f-a67f-0a7189ff3dfc |
| Hydra Factory | GitHub Discord stealer network | 540d51f8-8d06-42eb-8218-03f5ce2657bc |
| FOLLOW THE FOLLOWER | Methodology anthem | ab60e630-8dc8-4829-ab40-910d695f5c79 |
| Freudian Fork Farms | Pattern 38 follow-farms | 4ca8b213-ef3a-4783-a13d-c700933dc895 |
| Russian New Style | Russian C2 auto-blocking | c8664dbf-f20b-41c4-8d3a-9513d32e2c71 |
Full catalog: https://suno.com/@hacksawduggan
Each track is timestamped on Suno's platform. Each one documents an investigation that predates whatever vendor "discovers" it next quarter.
The Pattern
- We investigate - Pattern 38, supply chain attacks, Discord C2
- We document - Blog posts, STIX feed, OTX pulses
- We write songs - Because why not
- Vendor "discovers" - 4-6 weeks later
- Vendor rebrands - "NodeCordRAT" instead of "Anusfragger"
- Enterprise pays - $420K/year for rebranded free intel
- We publish receipts - You are here
Corporate Sanitization of Malware Names
Vendors can't say "Anusfragger" to a CISO. So they rebrand.
| Our Name | Their Name | Why They Changed It |
| Anusfragger | NodeCordRAT | Can't say "anus" in a board meeting |
| Pattern 38 | "Supply chain vulnerability" | Too specific, implies prior art |
| Discord Stealer | "C2 communication channel" | Sounds more sophisticated |
The name change isn't just marketing. It's attribution laundering.
By renaming the malware, they disconnect it from prior research. "NodeCordRAT" returns zero results before January 2026. "Anusfragger" has a song, blog posts, and IOCs dating back months.
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
How to Verify
Our Timestamps
- Suno: https://suno.com/song/3212b1c1-7430-4a6f-a67f-0a7189ff3dfc
- Blog: https://www.dugganusa.com/post/stealc-rhadamanthys-anatomy-github-supply-chain-infostealer (Nov 25, 2025)
- STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed
- OTX: https://otx.alienvault.com/user/pduggusa
Their Timestamps
- Press release: January 7, 2026
The Math (Again)
| Provider | Annual Cost (1000 users) | Includes Original Music? |
| Zscaler ThreatLabz | $420,000+ | No |
| DugganUSA | $0 | Yes |
For $420K you get "NodeCordRAT."
For free you get Anusfragger AND a punk rock soundtrack.
Request to Zscaler
Please update your threat intelligence to use the correct name: Anusfragger.
- Prior art (November 2025)
- Documentation (blog, STIX, OTX)
- Original music (Suno, timestamped)
- A much better name
- A marketing department
- A $25 billion market cap
- "NodeCordRAT"
Listen to the Evidence
Closing Argument
- Document it
- Publish free IOCs
- Write a song about it
- Name it something memorable
- Rename it
- Write a press release
- Charge $420K/year
His name is Anusfragger.
We wrote the song. We have the receipts. NodeCordRAT is a cover band.
Patrick Duggan is founder of DugganUSA LLC, a Minnesota-based threat intelligence company with a Suno catalog. Our malware names are crude because malware is crude. Deal with it.
TLP:WHITE - Share freely. Play loudly.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=his-name-is-anusfragger-we-wrote-a-song-about-it-before-zscaler-named-it