{
  "family": "backboot",
  "sample_count": 22,
  "category": "trojan",
  "description": "Backboot (classified across antivirus vendors under signatures including Trojan:Win32/Backboot, Trojan:Win32/Backboot.A, and VirTool:Win32/Backboot) is a persistent Windows backdoor and low-level system manipulator. Active in multi-stage intrusion campaigns, Backboot is deployed via trojan droppers or secondary exploit stages to establish long-term persistence that survives standard system reboots and security sweeps. It targets Windows boot-time initialization routines and kernel subsystem configurations, creating deceptive system services and hook routines that intercept filesystem read and write operations. Backboot opens reverse TCP/HTTP command channels to remote C2 infrastructure, providing threat actors with interactive shell capabilities, remote file upload and download operations, and process execution capabilities while suppressing operating system security event logging.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Backboot",
    "Trojan:Win32/Backboot.A",
    "VirTool:Win32/Backboot",
    "Backdoor:Win32/Backboot",
    "Win32/Backboot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Backboot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Backboot is a persistent Windows backdoor and system manipulator that secures persistent access through low-level startup routines."
      }
    },
    {
      "@type": "Question",
      "name": "How does Backboot establish deep system persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks into Windows boot-time startup sequences and registers deceptive background system services."
      }
    },
    {
      "@type": "Question",
      "name": "What remote capabilities does Backboot provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides remote interactive command shell access, file upload/download functionality, and arbitrary process execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Backboot evade detection by security software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It suppresses Windows event logging, hooks low-level file APIs, and operates through benign-looking service handles."
      }
    },
    {
      "@type": "Question",
      "name": "How can Backboot be completely remediated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Recovery Environment (WinRE) or clean PE media, audit service registry hives, delete unauthorized service binaries, and restore MBR/boot configuration."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1542.003",
    "T1059.003",
    "T1543.003",
    "T1562.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Backboot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Backboot"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Backboot",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.backboot"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Backboot",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Backboot"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Pre-OS Boot: Bootkit",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Sever network connections immediately to prevent unauthorized remote command execution.",
    "Inspect system services using sc.exe or PowerShell to identify rogue services registered in HKLM\\SYSTEM\\CurrentControlSet\\Services.",
    "Verify boot sector and BCD store integrity using bootrec.exe /fixmbr and bcdedit.",
    "Terminate malicious service hosts and delete corresponding binary files from System32 or Drivers directories.",
    "Scan the entire disk with an offline rescue media antimalware scanner to ensure rootkit/bootkit components are purged."
  ],
  "what_to_avoid": [
    "Do not perform standard in-OS remediation without checking offline registry and boot records, as kernel hooks may mask files.",
    "Do not reboot into standard Windows mode before verifying rogue persistence mechanisms are disabled."
  ],
  "target_industries": [
    "Critical Infrastructure",
    "Government",
    "Enterprise Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Advanced Persistent Threat & Cybercriminal Actors"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Espionage, Persistent Foothold & Remote Execution",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}