{
  "family": "bifrose",
  "sample_count": 59,
  "category": "backdoor",
  "description": "Bifrose (widely known across cybersecurity history as Bifrost, Backdoor:Win32/Bifrose, and Backdoor.Bifrost) is a landmark, enduring Remote Access Trojan (RAT) and backdoor active since 2004. Operating on a client-server architecture with dedicated builder utilities (Constructor:Win32/Bifrose), Bifrose has been heavily abused by cybercrime syndicates and targeted threat actors worldwide for over two decades. Once installed on a victim endpoint, the server component injects into explorer.exe or svchost.exe, establishes encrypted reverse TCP connections to remote attacker-controlled listeners, and provides complete remote administration capabilities. Features include keyboard logging, desktop surveillance, bidirectional file transfer, process and registry manipulation, webcam streaming, and network pivoting. Recent variants have expanded to target Linux and ARM systems, employing typosquatted C2 infrastructure to evade modern enterprise network inspection.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Bifrose",
    "Backdoor.Bifrost",
    "Bifrost RAT",
    "Constructor:Win32/Bifrose.A",
    "Bifrose"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Bifrose (Bifrost) RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bifrose/Bifrost is a historic remote access trojan active since 2004 providing full interactive remote control over infected hosts."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities are provided by the Bifrose server component?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keystroke logging, remote desktop streaming, microphone/webcam recording, file transfer, and process control."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bifrose conceal its execution on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects its malicious threads directly into legitimate system processes like explorer.exe or svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What builder utility is used to generate Bifrose payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers use the Constructor:Win32/Bifrose builder utility to configure C2 IP addresses, ports, and autostart keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Bifrose?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy modern endpoint detection (EDR), restrict unauthorized reverse TCP connections at the firewall, and patch vulnerabilities."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1056.001",
    "T1113",
    "T1125",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session and halt data exfiltration.",
    "Capture a full forensic memory image to extract the active Bifrose payload, its decrypted configuration, and its C2 infrastructure.",
    "Audit the Windows Registry (specifically Run keys and ActiveX configurations) to identify and remove the Bifrose persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or deploy ransomware.",
    "Avoid relying solely on file deletion; Bifrose runs in memory and will recreate deleted files if the injected process is not terminated."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access, Espionage & Cybercrime",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2004,
  "threat_actor": "Bifrost RAT Operators",
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Trojanized Software Installers",
    "Exploit Kits & Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Linux"
  ],
  "capabilities": [
    "Reverse TCP Shell Administration",
    "Process Memory Injection (explorer.exe)",
    "Keystroke Logging & Desktop Surveillance",
    "Bidirectional File System Access",
    "Webcam & Audio Streaming"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)",
      "ELF Binary (Linux variants)"
    ],
    "network_signatures": [
      "Custom encrypted reverse TCP sessions connecting to remote dynamic DNS endpoints",
      "Typosquatted domain infrastructure mimicking enterprise IT vendors"
    ],
    "evasion_techniques": [
      "Injecting execution threads into system binaries like explorer.exe",
      "Rootkit components hooking Windows native APIs"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BifrostServer",
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Total endpoint compromise, covert surveillance, sensitive document theft, lateral enterprise access"
  },
  "lineage": {
    "derived_from": [
      "Classic Windows Remote Access Trojans"
    ],
    "variants": [
      "Bifrost 1.2",
      "Bifrost 1.21",
      "Bifrost Linux (2024)"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b",
      "0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c"
    ],
    "delivery": [
      "bifrost_server.exe",
      "installer_update.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BifroseDaemon",
      "%SystemRoot%\\System32\\bifrost_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Bifrost Threat Analysis",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/Bifrose",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Bifrose"
    }
  ]
}