{
  "family": "jbonblanc",
  "sample_count": 0,
  "category": "trojan",
  "description": "JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remote access backdoor trojan developed during the early-to-mid 2000s cybercrime era. Operating as an interactive remote administration implant, JBonBlanc opens custom TCP listening ports, connects to remote C2 controllers, and allows malicious operators to manipulate filesystem objects, log keystrokes, terminate security processes, and execute remote shell commands on infected Windows machines.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/JBonBlanc",
    "Backdoor.Win32.JBonBlanc",
    "Trojan.JBonBlanc",
    "Win32/JBonBlanc.RAT",
    "Backdoor.JBonBlanc"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the JBonBlanc malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "JBonBlanc is an early Delphi remote access backdoor trojan designed for interactive remote endpoint surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can JBonBlanc perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "JBonBlanc provides keystroke logging, file upload/download, remote shell execution, and process termination."
      }
    },
    {
      "@type": "Question",
      "name": "How was JBonBlanc historically distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized utility software."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to JBonBlanc campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing JBonBlanc droppers have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against JBonBlanc?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce firewall egress filtering, deploy endpoint antimalware protection, and monitor registry Run keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to cut active remote command sessions.",
    "Kill malicious JBonBlanc server processes running out of %TEMP% or %APPDATA% directories.",
    "Delete persistence entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform a complete system antimalware scan to eliminate secondary dropped tools."
  ],
  "what_to_avoid": [
    "Do not execute software utilities downloaded from unverified peer-to-peer file-sharing networks.",
    "Avoid bypassing operating system warnings when launching unsigned executable binaries."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.JBonBlanc",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.JBonBlanc/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.JBonBlanc",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/jbonblanc"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "French Delphi RAT Architectures"
    ],
    "variants": [
      "JBonBlanc v1.0",
      "JBonBlanc Pro",
      "Win32/JBonBlanc.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\JBonBlanc",
      "Startup folder shortcut in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}