{
  "family": "back_orifice",
  "sample_count": 0,
  "category": "backdoor",
  "description": "Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cybersecurity history. Originally designed to demonstrate the inherent security weaknesses in Microsoft's Windows 95 and Windows 98 operating systems, it functioned as a powerful, stealthy client-server application. It allowed a remote user to control a machine across a network with virtually no indication to the local user. The server component, once installed, would silently listen for commands on a specified port, enabling the remote client to execute programs, manage the file system, view network connections, and even log keystrokes. Back Orifice was instrumental in raising public awareness about endpoint security and remote exploitation, prompting major shifts in how software vulnerabilities were addressed by vendors.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "BO",
    "Back Orifice 2000",
    "BO2K"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Back Orifice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Back Orifice is a seminal remote administration tool (RAT) developed by Cult of the Dead Cow in 1998."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed Back Orifice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was created by the hacker collective known as Cult of the Dead Cow (cDc)."
      }
    },
    {
      "@type": "Question",
      "name": "What operating systems did Back Orifice target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It primarily targeted the vulnerabilities present in Windows 95 and Windows 98."
      }
    },
    {
      "@type": "Question",
      "name": "What could an attacker do with Back Orifice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers could remotely execute commands, manage files, monitor network traffic, and log keystrokes without user knowledge."
      }
    },
    {
      "@type": "Question",
      "name": "What was the legacy of Back Orifice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It played a major role in exposing severe security flaws in early Windows systems, pushing the industry toward better security practices."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059",
    "T1056",
    "T1112",
    "T1083",
    "T1049"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1056",
      "name": "Input Capture",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1049",
      "name": "Technique",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Back Orifice binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Back Orifice installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Cult of the Dead Cow - Back Orifice 2000 Architecture",
      "url": "https://cultdeadcow.com"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-1999-0660",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-0660"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 1998,
  "motivation": "Financial Theft",
  "lineage": {
    "derived_from": [
      "cult_of_the_dead_cow_suite"
    ],
    "variants": [
      "bo2k",
      "back_orifice_1.2",
      "bo2k.gen"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-NTA",
    "D3-EFA",
    "D3-MFA"
  ],
  "cve": [
    "CVE-1999-0660",
    "CVE-2000-0347"
  ],
  "iocs": {
    "file_hashes": [
      "e5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6",
      "f6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7"
    ],
    "delivery": [
      "Direct network reconnaissance scanning UDP port 31337",
      "Trojanized system utilities and server wrappers shared via IRC and FTP"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\BOServer",
      "Registry Key HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BO2K"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}