{
  "family": "pbot",
  "sample_count": 22,
  "category": "trojan",
  "description": "Pbot (tracked under signatures Backdoor:Win32/Pbot, Trojan:Win32/Pbot, and Win32/Pbot) is a modular Windows remote access backdoor and network proxy agent. Infiltrating endpoints through drive-by exploit kits, malicious torrent downloads, and multi-stage trojan droppers, Pbot establishes a stealthy presence by injecting malicious threads into legitimate Windows system processes. It secures persistence by writing registry values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. Pbot connects to remote command-and-control servers using custom TCP or HTTP communication channels, transforming infected hosts into distributed proxy nodes for anonymizing malicious traffic. It supports dynamic module execution, allowing operators to run arbitrary remote commands, download secondary payloads, and capture sensitive network credentials.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Pbot",
    "Trojan:Win32/Pbot",
    "Win32/Pbot",
    "Backdoor.Pbot",
    "Trojan.Pbot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Pbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pbot is a modular Windows backdoor and network proxy trojan used for unauthorized remote control and traffic relaying."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pbot hide its malicious activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects malicious threads into legitimate Windows system processes and establishes disguised network sessions."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pbot turn infected hosts into network proxies?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sets up listening ports and forwards remote attacker traffic through the infected machine to obscure criminal infrastructure."
      }
    },
    {
      "@type": "Question",
      "name": "How is Pbot delivered to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through web exploit kits, infected software downloads, and secondary payload droppers."
      }
    },
    {
      "@type": "Question",
      "name": "What are the recommended remediation steps for Pbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate injected processes, remove Run registry values, block C2 communication channels, and conduct a thorough system scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1090",
    "T1055",
    "T1547.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Pbot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Pbot"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Pbot",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.win32.pbot"
    },
    {
      "name": "VirusTotal Threat Intelligence - Pbot Detection",
      "url": "https://www.virustotal.com/gui/home/upload"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the host from the internal network and external internet immediately to terminate proxy relaying.",
    "Kill unauthorized processes and audit memory space of injected Windows binaries.",
    "Remove startup values under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block outbound C2 IP addresses and suspicious proxy ports at network firewalls.",
    "Run an enterprise endpoint security scan to clean residual backdoor modules."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to route external traffic while under investigation.",
    "Do not overlook network traffic anomalies originating from legitimate system process names."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Commercial Businesses",
    "Telecommunications"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Cybercriminal Proxy Networks"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Distributed Proxying & Secondary Malware Delivery",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}