{ "family": "netwire", "sample_count": 55, "category": "rat", "description": "NetWire (cataloged across threat research as NetWire RAT, NetWire.RC, Backdoor:Win32/Netwire, and Trojan.Netwire) is a cross-platform remote access trojan (RAT) developed in C/C++ that was commercialized under the guise of legitimate remote administration by World Wired Labs (operated by Peter Salinger) from 2012 until its global law enforcement takedown by the FBI, Eurojust, and Australian Federal Police in March 2023. Unlike many contemporary RATs built on managed runtimes like .NET, NetWire was authored natively in C/C++, allowing it to execute with high performance, minimal memory footprints, and low detection footprints across Windows, Linux, and macOS platforms. Primarily distributed through targeted spear-phishing campaigns featuring malicious Microsoft Office documents exploiting legacy formula editor vulnerabilities (CVE-2017-11882) or archived ISO/LNK attachments, NetWire grants operators comprehensive command-and-control capabilities over compromised workstations. Its functionality includes low-level kernel keystroke logging via SetWindowsHookEx, spooling keystrokes into encrypted disk buffers, and mass credential harvesting targeting web browsers (Chrome, Edge, Firefox, Brave), email clients (Microsoft Outlook, Thunderbird), FTP clients (FileZilla, WinSCP), and cryptocurrency desktop wallets. The implant establishes reverse TCP/TLS sessions to operator listeners, incorporating socks4/5 reverse proxy tunneling, live desktop screen streaming via custom VNC implementations, webcam and microphone capture, and remote file management. NetWire was heavily co-opted by state-sponsored cyber espionage groups and Business Email Compromise (BEC) threat syndicates targeting financial services, manufacturing, healthcare, and maritime supply chains. In August 2020, CISA issued Advisory AA20-258A highlighting NetWire's role in commercial phishing infrastructure.", "cta": "Published by the SystemHelpdesk threat intelligence team.", "aliases": [ "RAT.NetWire", "Backdoor.NetWire", "Win32/NetWire", "NetWire.RC", "Trojan:Win32/Netwire", "World Wired Labs NetWire" ], "enrichment_level": "curated_sourced", "faq": [ { "@type": "Question", "name": "What is NetWire RAT and who created it?", "acceptedAnswer": { "@type": "Answer", "text": "NetWire is a native C/C++ multi-platform remote access trojan created and marketed under the facade of legitimate remote administration software by World Wired Labs starting in 2012. It was seized by the FBI, Eurojust, and global partners in March 2023." } }, { "@type": "Question", "name": "What platforms can NetWire infect?", "acceptedAnswer": { "@type": "Answer", "text": "While primarily targeting Microsoft Windows endpoints, NetWire was engineered with native cross-platform capabilities, including functional backdoor implants compiled for Linux, macOS, and Solaris environments." } }, { "@type": "Question", "name": "How does NetWire steal credentials and keystrokes?", "acceptedAnswer": { "@type": "Answer", "text": "NetWire hooks the Windows messaging subsystem via SetWindowsHookEx to log all user keystrokes into an encrypted log file on disk. It also extracts stored passwords, autofill tokens, and session cookies from browsers, Outlook, and cryptocurrency wallet applications." } }, { "@type": "Question", "name": "Why is NetWire heavily used in Business Email Compromise (BEC)?", "acceptedAnswer": { "@type": "Answer", "text": "NetWire provides BEC actors with silent, long-term persistence and keylogging capabilities, allowing threat actors to monitor executive correspondence, steal corporate email credentials, and hijack legitimate vendor payment threads to divert wire transfers." } }, { "@type": "Question", "name": "What happened during the March 2023 law enforcement takedown?", "acceptedAnswer": { "@type": "Answer", "text": "In March 2023, the U.S. Department of Justice, FBI Boston Division, Eurojust, and Australian Federal Police seized the worldwiredlabs.com domain, dismantled hosting infrastructure in Switzerland, and arrested the administrator in Croatia." } }, { "@type": "Question", "name": "How can defenders identify NetWire communication on network perimeters?", "acceptedAnswer": { "@type": "Answer", "text": "Defenders should inspect outbound non-standard TCP/TLS connections exhibiting custom binary handshake headers, enforce strict egress filtering, and deploy EDR rules detecting SetWindowsHookEx API calls originating from unverified PE binaries." } }, { "@type": "Question", "name": "How did NetWire RAT log keystrokes at the kernel/API level and steal credentials from early encrypted messaging apps?", "acceptedAnswer": { "@type": "Answer", "text": "NetWire utilized low-level Windows keyboard hooks (via SetWindowsHookEx and GetAsyncKeyState) to record keystrokes and capture active window titles into an encrypted log file. It was also one of the earliest commodity RATs to include automated extraction modules specifically targeting local database files and password caches for encrypted messaging clients (such as Pidgin, Skype, and ICQ) as well as Outlook and web browsers." } }, { "@type": "Question", "name": "What was the impact of the 2023 international law enforcement takedown of the worldwiredlabs[.]com infrastructure?", "acceptedAnswer": { "@type": "Answer", "text": "In March 2023, an international law enforcement operation led by the US FBI, Department of Justice, and Australian Federal Police seized the primary commercial sales domain worldwiredlabs[.]com and arrested the platform administrator. The operation dismantled NetWire's licensing servers and customer portals, crippling commercial support for the RAT and leading to a significant decline in NetWire phishing distributions globally." } } ], "faq_count": 8, "mitre_attack": [ "T1056.001", "T1555.003", "T1071.001", "T1055.012", "T1547.001", "T1105", "T1113", "T1125", "T1090.001" ], "cisa_advisory": "AA20-258A", "exploited_cves": [ "CVE-2017-11882", "CVE-2017-0199", "CVE-2012-0158" ], "last_updated": "2026-10-16", "sources": [ { "name": "U.S. Department of Justice: NetWire RAT Infrastructure Seizure", "url": "https://www.justice.gov/usao-ma/pr/fbi-seizes-website-offering-netwire-remote-access-trojan" }, { "name": "CISA Alert AA20-258A: Guidance on NetWire and Phishing Threats", "url": "https://www.cisa.gov/news-events/alerts/2020/09/14/cisa-releases-analysis-report-netwire" }, { "name": "Eurojust: International Operation Takedown of NetWire Malware", "url": "https://www.eurojust.europa.eu/news/netwire-malware-taken-down-global-operation" }, { "name": "Mandiant: NetWire RAT Weaponized in BEC and Phishing Campaigns", "url": "https://www.mandiant.com/resources/blog/netwire-rat-analysis" } ], "iocs": { "file_hashes": [ "88a107ef4ef3b34208a0df70216b3f7f8d689626bc6594c9f187a27eb2a29c15", "6880df8cfb2b73ecf5cefa1d2df0f6ba2360b64bebf80c8502f232599c279c65", "3e62f02cb8594d6e902b115ee877990155b46e38a202722b51ee2bc3a4ea8474" ], "delivery": [ "Spear-phishing emails disguised as shipping notices, purchase orders, or wire remittances", "Weaponized Office documents exploiting Equation Editor CVE-2017-11882 and CVE-2017-0199", "Archived ISO, IMG, or ZIP attachments containing obfuscated VBScript or LNK shortcut droppers" ], "persistence": [ "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Netwire", "Startup folder shortcut placement: %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", "Hidden executable dropping into %APPDATA%\\Logs or %APPDATA%\\Install with randomized naming" ] }, "lineage": { "derived_from": [ "world_wired_labs" ], "variants": [ "netwire_rc", "netwire_v3", "netwire_crossplatform" ] }, "ecosystem": [ "windows", "linux", "macos" ], "attack_stage": [ "initial_access", "execution", "persistence", "credential_access", "discovery", "collection", "command_and_control", "exfiltration" ], "target_platforms": [ "Windows 11", "Windows 10", "Windows Server 2022", "Windows Server 2019" ] }