{
  "family": "bifrost",
  "sample_count": 95,
  "category": "rat",
  "description": "Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT) that first surfaced in 2004 and maintained widespread operational use for over a decade in both financially motivated crimeware and state-sponsored cyber espionage campaigns. Authored in C++, Bifrost features a dual-mode communication architecture supporting both direct connection and reverse connection proxying, allowing operators to bypass corporate firewalls and NAT perimeters without requiring port forwarding on victim networks. The implant incorporates sophisticated kernel-level rootkit capabilities: it hooks the Windows System Service Dispatch Table (SSDT) and subverts Native API functions (including ZwQueryDirectoryFile and ZwQuerySystemInformation) to hide its files, registry entries, and network connections from Windows Task Manager and traditional antivirus scanners. Bifrost grants operators extensive remote workstation surveillance, including low-level keystroke logging via custom hook DLLs, webcam capture, screen surveillance, file transfer, remote shell execution, and registry editing. Threat actors frequently package Bifrost using multi-layered runtime crypters and deploy it via targeted spear-phishing emails containing exploit documents targeting vulnerabilities such as CVE-2012-0158 and CVE-2010-0805.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "Bifrose",
    "Backdoor:Win32/Bifrose",
    "Trojan.Bifrose",
    "Win32/Bifrose",
    "Bifrost RAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Bifrost (Bifrose) and when did it emerge?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bifrost is a veteran C++ remote access trojan that emerged in 2004, used extensively by cybercriminals and advanced persistent threat groups for remote surveillance and workstation takeover."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bifrost hide its processes and files from detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bifrost integrates rootkit functionality that hooks Native Windows APIs (such as ZwQueryDirectoryFile) to hide its executable files, registry keys, and network sockets from Task Manager and security tools."
      }
    },
    {
      "@type": "Question",
      "name": "What communication modes does Bifrost support?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It supports both direct listening connections and reverse connections, allowing compromised internal endpoints to connect outbound to attacker-controlled C2 servers to easily bypass firewalls."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Bifrost offer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bifrost features real-time keystroke logging, screen viewing, webcam spying, remote command execution, file system management, and password dumping."
      }
    },
    {
      "@type": "Question",
      "name": "How can security teams detect Bifrost infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By monitoring for unauthorized SSDT or user-mode API hooking, inspecting memory dumps for injected Bifrost DLLs, and tracking outbound TCP connections with custom encrypted binary handshake headers."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1014",
    "T1113",
    "T1125",
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "exploited_cves": [
    "CVE-2012-0158",
    "CVE-2010-0805"
  ],
  "iocs": {
    "file_hashes": [
      "24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c",
      "ed01ebf8304d164ff5fe90222e3e5fc132e169a4ccdd6e5e30e3f90fb1b49c71"
    ],
    "delivery": [
      "Spear-phishing emails containing malicious Microsoft Office attachments exploiting CVE-2012-0158",
      "Drive-by compromise downloads from hijacked websites exploiting CVE-2010-0805",
      "Bundled trojan installers shared on public peer-to-peer file networks"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bifrost",
      "Rootkit service installation hooking kernel dispatch routines",
      "Process injection into winlogon.exe or explorer.exe"
    ]
  },
  "lineage": {
    "derived_from": [],
    "variants": [
      "bifrost_v1.1",
      "bifrost_v1.2",
      "bifrose_rootkit"
    ]
  },
  "ecosystem": [
    "windows",
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "privilege_escalation",
    "defense_evasion",
    "credential_access",
    "discovery",
    "collection",
    "command_and_control"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "Trend Micro: Bifrose Malware Family Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_bifrose"
    },
    {
      "name": "Symantec Threat Intelligence: Backdoor.Bifrose Technical Details",
      "url": "https://www.broadcom.com/support/security-center"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}