{
  "family": "flux",
  "sample_count": 1500,
  "category": "backdoor",
  "description": "Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfaced during the early-to-mid 2000s cybercrime era. Developed to establish persistent remote command-and-control over compromised Windows endpoints, Flux listens on custom TCP ports or connects back to attacker-designated command infrastructure. The backdoor equips remote operators with full interactive shell access, enabling file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Flux was distributed across peer-to-peer file sharing networks, IRC chat networks, and bundled with freeware game utilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Flux",
    "Trojan.Win32.Flux",
    "Win32/Flux.Backdoor",
    "Backdoor.Flux.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Flux backdoor malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Flux is a Delphi-based remote access backdoor trojan that grants attackers full interactive command shell control over infected hosts."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Flux provide to remote operators?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Capabilities include file upload/download, remote shell execution, process termination, registry modification, and system rebooting."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors propagate Flux?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Flux was primarily distributed across peer-to-peer (P2P) file networks and IRC channels disguised as cracked software and media files."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Flux campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering Flux droppers have exploited document and shortcut vulnerabilities including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be secured against Flux infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block unauthorized inbound/outbound TCP connections at firewalls, implement EDR monitoring, and audit autostart registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105",
    "T1562.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the affected machine from local networks to sever active backdoor command sessions.",
    "Terminate active Flux listener threads and child process shells spawned via cmd.exe.",
    "Delete malicious autostart registry keys under HKLM and HKCU Run keys.",
    "Perform a complete forensic disk scan to detect and remove secondary tools dropped by remote operators."
  ],
  "what_to_avoid": [
    "Do not allow direct, uninspected inbound connections on non-standard TCP ports.",
    "Avoid executing pirated software utilities downloaded from unverified peer-to-peer file-sharing networks."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Flux",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Flux/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Flux.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/flux"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Architectures"
    ],
    "variants": [
      "Flux.v1",
      "Flux.v2",
      "Win32/Flux.B"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d",
      "0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e"
    ],
    "delivery": [
      "Peer-to-peer file-sharing networks disguised as multimedia utilities and software cracks",
      "IRC DCC file transfer lures and malicious script downloads"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FluxServer",
      "Creation of auto-start Windows service keys under HKLM\\SYSTEM\\CurrentControlSet\\Services"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}