{
  "family": "netwiredrc",
  "sample_count": 72,
  "category": "rat",
  "description": "Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially marketed by WorldWiredLabs before being dismantled in March 2023 in an international law enforcement operation led by the FBI, US Attorney's Office (Central District of California), and Europol. Operating stealthily across Windows, Linux, and macOS platforms, NetWire provides adversaries with complete remote desktop surveillance, multi-browser password and cookie scraping, automated offline and online keystroke logging, reverse command shells, and file transfer capabilities. Extensively deployed by initial access brokers, business email compromise (BEC) operators, and state-sponsored cyber espionage syndicates, NetWire was distributed through spear-phishing campaigns weaponized with malicious document exploits (such as Equation Editor flaws CVE-2017-11882 and CVE-2018-0802).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "NetWire",
    "NetWire RAT",
    "NetWiredRC",
    "Trojan:Win32/Netwire",
    "Backdoor.Netwire",
    "WorldWiredLabs NetWire",
    "Trojan.NetWire"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is NetWire (NetWiredRC) malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetWire is a multi-platform Remote Access Trojan (RAT) and credential stealer commercially sold by WorldWiredLabs and widely abused in global cybercrime."
      }
    },
    {
      "@type": "Question",
      "name": "What happened during the law enforcement takedown of NetWire?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In March 2023, the FBI, US Department of Justice, and Europol seized WorldWiredLabs domains and arrested its administrator in Croatia."
      }
    },
    {
      "@type": "Question",
      "name": "What operating systems can NetWire infect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetWire is a cross-platform backdoor capable of executing on Microsoft Windows, Linux, Android, and macOS environments."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does NetWire provide attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetWire logs keystrokes, captures webcam video and audio, extracts passwords from browsers and email clients, and opens interactive command shells."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were commonly used to drop NetWire?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NetWire phishing campaigns frequently exploited Microsoft Office vulnerabilities including CVE-2017-11882 and CVE-2018-0802."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555",
    "T1059.003",
    "T1113",
    "T1125",
    "T1071.001",
    "T1547.001",
    "T1055"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "credential-access"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "collection"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    }
  ],
  "cisa_advisory": "AA20-205A",
  "last_updated": "2026-10-14",
  "first_seen": 2012,
  "lineage": {
    "derived_from": [],
    "variants": [
      "netwire v1.x",
      "netwire v3.x cross-platform build",
      "worldwiredlabs commercial build"
    ]
  },
  "attribution": [
    {
      "actor": "WorldWiredLabs / Global Cybercrime & BEC Syndicates",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2017-11882",
    "CVE-2018-0802"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "HTTP",
      "TLS"
    ],
    "ports": [
      443,
      3389,
      8080
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b",
      "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d"
    ],
    "delivery": [
      "spearphishing_attachments",
      "malicious_invoice_documents"
    ],
    "persistence": [
      "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "AppData directory hidden log files"
    ]
  },
  "sources": [
    {
      "name": "US Department of Justice: NetWire RAT Infrastructure Seized and Administrator Arrested",
      "url": "https://www.justice.gov/usao-cdca/pr/fbi-seizes-website-offering-netwire-remote-access-trojan-used-conduct-illicit-wiretaps-and"
    },
    {
      "name": "Europol: Coordinated Takedown of NetWire RAT Commercial Infrastructure",
      "url": "https://www.europol.europa.eu/media-press/newsroom/news/international-police-cooperation-takes-down-netwire-malware"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2017-11882",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11882"
    }
  ],
  "containment_steps": [
    "Immediately isolate suspect workstations from the corporate network to prevent live operator surveillance.",
    "Capture volatile memory to extract the unencrypted NetWire C2 configuration, ports, and encryption keys.",
    "Reset credentials for all email accounts, banking interfaces, and VPN logins accessed from the host.",
    "Deploy security updates patching Microsoft Office Equation Editor vulnerabilities CVE-2017-11882 and CVE-2018-0802."
  ],
  "what_to_avoid": [
    "Do not allow unmonitored TCP egress connections over non-standard ports from corporate endpoints.",
    "Avoid opening unsolicited commercial billing attachments without sandbox inspection.",
    "Never assume an infection is benign; NetWire allows real-time interactive command execution."
  ],
  "target_industries": [
    "financial_services",
    "healthcare",
    "manufacturing",
    "small_business",
    "legal_services"
  ],
  "motivation": "Business Email Compromise (BEC), Financial Theft & Covert Cyber Surveillance",
  "threat_actors": [
    "Global Cybercrime Syndicates",
    "BEC Operators"
  ],
  "target_geographies": [
    "US",
    "GB",
    "DE",
    "FR",
    "AU",
    "CA",
    "IT",
    "ES"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "credential-access",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "linux",
    "macos"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}