{
  "family": "nuclear_rat",
  "sample_count": 0,
  "category": "rat",
  "description": "Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Access Trojan created in 2003 by the developer 'caesar2k'. Programmed in C++ and Visual C++, Nuclear RAT gained prominence in early cybercrime circles due to its reverse-connection architecture, allowing it to bypass inbound perimeter NAT firewalls by having the compromised client initiate outbound TCP sessions to the operator's DNS or IP. Features include an interactive remote command shell, full file system manipulation, live desktop streaming, webcam frame capture, audio microphone eavesdropping, process injection, keystroke logging, and early rootkit hooks designed to conceal its process image from the Windows Task Manager.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "NuclearRAT",
    "Nuclear RAT 2.1",
    "Backdoor.NuclearRat",
    "Trojan.NuclearRAT",
    "Win32/NuclearRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Nuclear RAT remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nuclear RAT is an early C++ Remote Access Trojan created in 2003 that popularized reverse-connection outbound C2 communications."
      }
    },
    {
      "@type": "Question",
      "name": "Why was Nuclear RAT considered technically significant?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It established early standards for NAT firewall traversal via reverse callbacks and integrated rootkit process hiding hooks."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features did Nuclear RAT provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provided desktop streaming, webcam capture, microphone eavesdropping, keystroke logging, and remote shell access."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been associated with Nuclear RAT delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing retro RAT droppers have exploited document and shortcut flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Nuclear RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce firewall egress filtering, monitor autostart registry entries, and deploy modern EDR agents capable of detecting unhooked processes."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055.002",
    "T1056.001",
    "T1113",
    "T1125",
    "T1123",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Sever outbound network connections immediately to block reverse-connection C2 communication.",
    "Inspect running processes and loaded modules using kernel diagnostic tools to reveal hidden binaries.",
    "Remove persistent startup keys located in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Deploy endpoint security software to quarantine dropped executables and clean hooked APIs."
  ],
  "what_to_avoid": [
    "Do not rely solely on standard Task Manager to verify infection status, as rootkit hooks may conceal the process.",
    "Avoid entering sensitive administrative credentials before performing full system memory verification."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.NuclearRAT",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.NuclearRAT/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.NuclearRAT",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/nuclearrat"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control",
    "collection"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2003,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Early C++ Reverse RAT Frameworks"
    ],
    "variants": [
      "Nuclear RAT 1.0",
      "Nuclear RAT 2.0",
      "Nuclear RAT 2.1"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
      "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Exploitation of shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NuclearServer",
      "Startup folder link placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}