{
  "family": "lost_door",
  "sample_count": 0,
  "category": "rat",
  "description": "Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Access Trojan (RAT) created in 2007 by an underground developer known as 'Türkojan' / 'Lost_Door'. Widely adopted across global cybercriminal forums, Lost Door provides full remote administrative control over compromised Windows endpoints. Its capabilities include real-time desktop screen capture, webcam surveillance, audio recording, reverse command shells, registry editing, active process management, and automated password extraction from web browsers, email clients, and instant messengers. Lost Door was commonly distributed through peer-to-peer file sharing networks, malicious email attachments, and trojanized freeware software bundles.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor.LostDoor",
    "Trojan.Win32.LostDoor",
    "Backdoor:Win32/LostDoor",
    "Win32/LostDoor.RAT",
    "LostDoor.E-Server"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Lost Door remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lost Door is a modular Delphi Remote Access Trojan developed in 2007 providing full interactive surveillance and remote control."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance modules are included in Lost Door?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Modules include live webcam capture, microphone eavesdropping, keystroke logging, screen viewing, and password theft."
      }
    },
    {
      "@type": "Question",
      "name": "How was Lost Door propagated across victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat file transfers, and trojanized gaming cracks."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Lost Door delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering Lost Door droppers have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Lost Door?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce firewall egress filtering, deploy endpoint antimalware protection, and monitor registry Run keys and active sockets."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1123",
    "T1059.003",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to cut active remote command sessions and stop live webcam/desktop streaming.",
    "Kill active Lost Door server processes and remove autostart entries.",
    "Purge persistence registry entries located under HKLM and HKCU Run keys.",
    "Perform an enterprise-wide password reset for all user accounts accessed from the infected workstation."
  ],
  "what_to_avoid": [
    "Do not execute software downloaded from unverified peer-to-peer file sharing repositories or forum links.",
    "Avoid continuing operation of a compromised endpoint without thorough forensic memory triage."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.LostDoor",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.LostDoor/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.LostDoor",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/lostdoor"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2007,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi RAT Frameworks"
    ],
    "variants": [
      "Lost Door v6.0",
      "Lost Door v8.0",
      "Lost Door Fly Edition"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f",
      "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Phishing emails with malicious Microsoft Office attachments exploiting CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LostDoorServer",
      "Startup folder shortcut in %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}