{
  "family": "hav_rat",
  "sample_count": 1500,
  "category": "rat",
  "description": "Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Trojan (RAT) first observed in the early-to-mid 2000s cybercrime ecosystem. Designed to furnish remote malicious operators with complete interactive administrative dominion over compromised Windows endpoints, Hav-RAT listens on custom TCP ports or initiates reverse connections to dynamic DNS C2 servers. The trojan incorporates extensive surveillance and control modules, including real-time desktop screen capture, keystroke logging, active process enumeration and termination, remote file upload and download, remote registry editing, and interactive command shell spawning.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/HavRAT",
    "Trojan.Win32.HavRAT",
    "Backdoor.HavRat",
    "Win32/HavRat.RAT",
    "Trojan.HavRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Hav-RAT and what are its origins?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hav-RAT is a classic Delphi Remote Access Trojan developed in the mid-2000s to grant attackers unauthorized administrative remote control."
      }
    },
    {
      "@type": "Question",
      "name": "What interactive capabilities does Hav-RAT provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hav-RAT provides screen capture, keystroke logging, file system manipulation, process management, and interactive command shells."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors distribute Hav-RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat DCC file transfers, and trojanized software utilities."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Hav-RAT campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing Hav-RAT droppers have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be safeguarded against Hav-RAT infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce firewall egress filtering on non-standard TCP ports, deploy endpoint detection and response (EDR), and audit registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to prevent ongoing interactive remote desktop streaming and lateral traversal.",
    "Terminate active Hav-RAT server processes and spawned cmd.exe command shells.",
    "Purge autostart registry entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Reset user credentials and conduct full endpoint forensic memory triage to identify secondary dropped implants."
  ],
  "what_to_avoid": [
    "Do not allow uninspected inbound connections on non-standard TCP listening ports across corporate perimeter firewalls.",
    "Avoid downloading or running pirated software from unverified peer-to-peer file sharing repositories."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.HavRAT",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.HavRAT/"
    },
    {
      "name": "Sophos Threat Center - Troj/HavRat-A Breakdown",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~HavRat-A"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi RAT Frameworks"
    ],
    "variants": [
      "Hav-RAT 1.0",
      "Hav-RAT Pro",
      "Win32/HavRat.B"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b",
      "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Phishing emails with malicious Microsoft Office attachments exploiting CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HavRatServer",
      "Auto-start Windows service registered under HKLM\\SYSTEM\\CurrentControlSet\\Services\\HavRatSvc"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}