{
  "family": "messiah",
  "sample_count": 0,
  "category": "trojan",
  "description": "Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access trojan that surfaced in the early-to-mid 2000s cybercrime era. Developed to establish persistent unauthorized control over compromised Windows endpoints, Messiah listens on custom TCP ports or connects back to attacker-designated command infrastructure. The trojan equips remote operators with interactive shell access, file uploading and downloading, process termination, system rebooting, user account manipulation, and arbitrary command execution. Messiah was distributed across peer-to-peer file sharing networks, IRC DCC file transfers, and bundled with freeware game utilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Messiah",
    "Backdoor.Win32.Messiah",
    "Trojan.Messiah",
    "Win32/Messiah.RAT",
    "Messiah.Server"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Messiah trojan family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Messiah is an early Delphi remote access trojan and backdoor designed for interactive remote endpoint surveillance."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions can Messiah execute?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Actions include file upload/download, remote shell execution, process termination, registry modification, and rebooting."
      }
    },
    {
      "@type": "Question",
      "name": "How did threat actors propagate Messiah?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized utility software."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Messiah campaigns?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering Messiah droppers have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Messiah?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce firewall egress filtering, deploy endpoint antimalware protection, and monitor registry Run keys and active sockets."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1071.001",
    "T1547.001",
    "T1105",
    "T1562.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to cut active remote command sessions.",
    "Kill malicious Messiah server processes running out of %TEMP% or %APPDATA% directories.",
    "Delete persistence entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Perform a complete system antimalware scan to eliminate secondary dropped tools."
  ],
  "what_to_avoid": [
    "Do not execute software utilities downloaded from unverified peer-to-peer file-sharing networks.",
    "Avoid bypassing operating system warnings when launching unsigned executable binaries."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Messiah",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Messiah/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Messiah",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/messiah"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2004,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi Backdoor Frameworks"
    ],
    "variants": [
      "Messiah v1.0",
      "Messiah Pro",
      "Win32/Messiah.Gen"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a",
      "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "IRC DCC file transfer lures and malicious download links"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MessiahServer",
      "Startup folder shortcut placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}