{
  "family": "hue",
  "sample_count": 1500,
  "category": "trojan",
  "description": "Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan and staging dropper that surfaced in the mid-2000s cybercrime landscape. Engineered to provide covert persistent access, Hue injects lightweight execution threads into native Windows desktop processes, establishes reverse command-and-control communication with attacker infrastructure, and bypasses rudimentary signature scanning using simple string XOR encryption. The trojan allows remote operators to execute shell commands, upload and download files, terminate local antivirus processes, and deploy secondary malware modules onto the compromised system.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Hue",
    "Backdoor:Win32/Hue",
    "Trojan.Win32.Hue",
    "Win32/Hue.Backdoor",
    "Backdoor.Hue.Gen"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Hue trojan family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hue is a classic Delphi remote access backdoor trojan and staging dropper from the mid-2000s."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hue compromise Windows endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hue compromises endpoints via peer-to-peer file sharing downloads, malicious email lures, and trojanized utility bundles."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can Hue execute?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can execute arbitrary shell commands, upload/download files, terminate processes, and drop secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Hue campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering Hue have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can security analysts remediate a Hue infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate active Hue processes, delete persistence registry keys under Run, and perform full endpoint antimalware scans."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105",
    "T1562.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to cut active command-and-control beaconing channels.",
    "Kill malicious Hue payload binaries running out of %TEMP% or %APPDATA% directories.",
    "Remove persistence entries under HKCU and HKLM Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform a complete forensic disk scan to detect and remove secondary tools dropped by remote operators."
  ],
  "what_to_avoid": [
    "Do not execute software utilities from unknown third-party download mirrors.",
    "Avoid bypassing operating system warnings when launching unsigned executables."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Hue",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Hue/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Hue",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/hue"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2005,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Architectures"
    ],
    "variants": [
      "Hue.v1",
      "Hue.v2",
      "Win32/Hue.Dropper"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c",
      "8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and utility installers",
      "Secondary dropper execution via malicious script lures"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HueClient",
      "Startup folder shortcut in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}