{
  "family": "cybergate",
  "sample_count": 7,
  "category": "rat",
  "description": "Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ecosystem throughout the late 2000s and 2010s. Furnishing threat actors with a fully featured graphical administration console, CyberGate allows operators to execute arbitrary commands, intercept webcam and audio hardware streams, record user keystrokes in real time, scrape credentials from local web browsers and instant messengers, manipulate the system registry, and tunnel unauthorized traffic. CyberGate was heavily distributed via malicious spam containing weaponized Office documents and trojanized software downloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "CyberGate",
    "CyberGate RAT",
    "Trojan:Win32/CyberGate",
    "Backdoor.CyberGate",
    "Win32/CyberGate",
    "Trojan.CyberGate"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is CyberGate RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CyberGate is a commercial Delphi-based Remote Access Trojan providing complete GUI control, keystroke logging, and webcam surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does CyberGate feature?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CyberGate can capture live webcam streams, record microphone audio, monitor keystrokes, and steal saved browser passwords."
      }
    },
    {
      "@type": "Question",
      "name": "How does CyberGate establish persistence in Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CyberGate injects its modules into legitimate processes like explorer.exe and registers auto-start entries in Windows Run registry keys."
      }
    },
    {
      "@type": "Question",
      "name": "How was CyberGate distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CyberGate was distributed via malicious email attachments, cracked application packages, and peer-to-peer file downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were exploited in CyberGate campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CyberGate campaigns weaponized Windows Shell shortcut flaw CVE-2010-2568 and Office vulnerability CVE-2012-0158."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1059.003",
    "T1055",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "collection"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2008,
  "lineage": {
    "derived_from": [],
    "variants": [
      "cybergate v1.x",
      "cybergate v2.x delphi build",
      "cybergate v3.4 crack"
    ]
  },
  "attribution": [
    {
      "actor": "Underground Cybercrime Groups",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "HTTP"
    ],
    "ports": [
      80,
      3460,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7f",
      "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a"
    ],
    "delivery": [
      "spearphishing_attachments",
      "trojanized_software_installers"
    ],
    "persistence": [
      "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "explorer.exe process injection"
    ]
  },
  "sources": [
    {
      "name": "MITRE ATT&CK Software S0109: CyberGate Technical Entry",
      "url": "https://attack.mitre.org/software/S0109/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia: CyberGate Remote Access Trojan Assessment",
      "url": "https://www.trendmicro.com/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2012-0158",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0158"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints immediately to stop live interactive attacker surveillance.",
    "Capture live RAM to extract the unencrypted CyberGate C2 IP address and listening port.",
    "Reset credentials for any corporate email or banking systems accessed from the infected workstation.",
    "Deploy security updates patching Microsoft Office memory corruption vulnerability CVE-2012-0158."
  ],
  "what_to_avoid": [
    "Do not attempt to interact with the attacker via on-screen messaging prompts.",
    "Avoid operating endpoints with unmonitored outbound TCP communication to dynamic DNS domains.",
    "Never execute untrusted files claiming to be cracked corporate software suites."
  ],
  "target_industries": [
    "consumers",
    "small_business",
    "education",
    "financial_services"
  ],
  "motivation": "Financial Theft, Remote Surveillance & Initial Access Brokerage",
  "threat_actors": [
    "Underground Cybercrime Groups"
  ],
  "target_geographies": [
    "US",
    "BR",
    "DE",
    "FR",
    "IT",
    "ES",
    "TR"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "credential-access",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}