{
  "family": "hafen",
  "sample_count": 120,
  "category": "backdoor",
  "description": "Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to maintain covert operational persistence within compromised corporate networks, Hafen is delivered primarily through spearphishing emails carrying weaponized document droppers or deployed as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated binary payload, copies itself into %APPDATA% or %SYSTEMROOT% directories disguised as a legitimate Windows administrative utility, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To bypass host intrusion prevention systems (HIPS) and conceal outbound communications, Hafen injects its networking modules into trusted system processes such as svchost.exe. Once anchored, Hafen initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Hafen",
    "BKDR_HAFEN.A",
    "Trojan:Win32/Hafen",
    "Win32/Hafen",
    "Trojan.Hafen"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Hafen backdoor family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hafen is a stealthy Windows Remote Access Trojan (RAT) that gives remote attackers persistent interactive command execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hafen arrive on victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through spearphishing emails with malicious document attachments and drive-by web exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hafen conceal its execution in memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects its backdoor communication modules into trusted Windows processes such as svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Hafen grant to remote attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enables interactive command execution, system reconnaissance, file uploading and downloading, and keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Hafen compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate injected processes, block C2 communication endpoints, and initiate a full credential reset."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2012,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Win32 Remote Access Trojan Architecture",
      "Process Hollowing Backdoor Framework"
    ],
    "variants": [
      "Hafen.A",
      "Hafen.B",
      "Hafen.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1053.005",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the infected host from the corporate network immediately to terminate the active backdoor connection.",
    "Conduct volatile memory analysis using EDR to identify and terminate hollowed or injected svchost.exe processes.",
    "Delete persistent scheduled tasks and registry keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block identified C2 IP addresses and domains at the perimeter firewall, and rotate credentials for all compromised accounts."
  ],
  "what_to_avoid": [
    "Do not allow the infected system to remain networked while investigating, as attackers retain active shell control.",
    "Avoid opening macro-enabled attachments from unverified external senders."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Manufacturing",
    "Government",
    "Information Technology"
  ],
  "threat_actors": [
    "Unknown / Cyber Espionage Group"
  ],
  "target_geographies": [
    "Global",
    "Europe",
    "North America"
  ],
  "attack_stage": [
    "command_and_control",
    "remote_access",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "iocs": {
    "file_hashes": [
      "d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5e7b9d1f3a5c7e9b1d3f5",
      "e4a6c8e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6"
    ],
    "delivery": [
      "Targeted spearphishing emails carrying weaponized document droppers",
      "Drive-by browser exploits targeting vulnerable third-party plugins"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Hafen",
      "%APPDATA%\\Microsoft\\Hafen\\hafen.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/Hafen",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Hafen"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - BKDR_HAFEN.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}