{
  "family": "orcus",
  "sample_count": 66,
  "category": "backdoor",
  "description": "Orcus RAT (cataloged across security vendors and threat intelligence databases as Backdoor:Win32/Orcus, MSIL/Orcus, and Orcus RAT) is a notorious, modular .NET remote access trojan first surfacing in 2016. Developed by German programmer Vincent Leo Griebel and marketed by Canadian citizen John Paul Revesz under the commercial front 'Orcus Technologies', the tool was ostensibly sold as a legitimate remote administration utility while being advertised and utilized extensively across cybercrime forums. Following an extensive international investigation, Canada's CRTC issued landmark penalties against Orcus Technologies for computer malware distribution. Architecturally, Orcus features an extensible C# plugin system, evasion routines that detect sandbox and virtual machine environments, and scheduled task persistence via 'Orcus Respawner'. Attackers utilize Orcus to log keystrokes, capture webcam footage, record audio, steal browser passwords and cryptocurrency wallets, and launch distributed denial-of-service (DDoS) attacks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Orcus",
    "MSIL/Orcus",
    "Orcus RAT",
    "Trojan:MSIL/Orcus"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Orcus RAT operation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Orcus RAT was a modular .NET remote access trojan sold commercially by Orcus Technologies and widely abused for cybercrime."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed and marketed Orcus RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was developed by Vincent Leo Griebel and marketed by John Paul Revesz, resulting in landmark CRTC regulatory penalties."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features are built into Orcus RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Webcam streaming without LED activation, microphone recording, keylogging, and browser password/cookie harvesting."
      }
    },
    {
      "@type": "Question",
      "name": "How does Orcus maintain persistence on compromised computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows scheduled tasks through a watchdog module known as 'Orcus Respawner'."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Orcus RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the computer, terminate running Orcus processes, remove 'Orcus Respawner' tasks, and run a full antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1053.005",
    "T1555.003",
    "T1498",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video/Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately sever the endpoint from the network to terminate the active Orcus session, halting data exfiltration and preventing the attacker from triggering a BSOD.",
    "Do NOT reboot the machine immediately; capture a forensic memory image to extract the active Orcus configuration and C2 details.",
    "Force a global password reset for all accounts accessed by the user, as Orcus aggressively targets saved browser and email credentials.",
    "Assume the machine is fully compromised; perform a clean operating system rebuild to ensure complete eradication."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and can manually destroy evidence.",
    "Avoid relying solely on file deletion; Orcus often runs in memory and will recreate deleted files if the injected process is not killed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Cybercrime, Espionage & Commercial Malware Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": "Orcus Technologies (Vincent Leo Griebel & John Paul Revesz)",
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Trojanized Video Game Cheats & Keygens",
    "Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Extensible C# Plugin Architecture",
    "Silent Webcam and Microphone Surveillance",
    "Keystroke Logging",
    "Credential & Crypto Wallet Harvesting",
    "DDoS Flooding Capabilities"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET Framework Assembly (C#)",
      "Dynamic Link Library (DLL)",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Encrypted TCP communication with custom binary headers connecting to C2 listeners",
      "DDoS stress testing packet floods (TCP/UDP/HTTP)"
    ],
    "evasion_techniques": [
      "Anti-analysis and sandbox checks querying virtualization registry keys",
      "Commercial .NET packers and string encryptors"
    ],
    "persistence_mechanisms": [
      "Scheduled task: 'Orcus Respawner.job'",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\OrcusClient"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Total remote computer takeover, covert audiovisual surveillance, credential and cryptocurrency theft"
  },
  "lineage": {
    "derived_from": [
      "Commercial .NET Remote Access Trojans"
    ],
    "variants": [
      "Orcus 1.9",
      "Orcus 2.0",
      "Orcus.MSIL"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f",
      "0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a"
    ],
    "delivery": [
      "client_orcus.exe",
      "game_trainer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Orcus",
      "%AppData%\\Orcus\\Orcus.exe"
    ]
  },
  "sources": [
    {
      "name": "Canadian Radio-television and Telecommunications Commission (CRTC) - Orcus Technologies Enforcement Decision",
      "url": "https://www.crtc.gc.ca"
    },
    {
      "name": "Palo Alto Networks Unit 42 - Analysis of Orcus RAT Plugins and Cybercrime Adoption",
      "url": "https://unit42.paloaltonetworks.com"
    }
  ]
}