{
  "family": "rbot",
  "sample_count": 109,
  "category": "backdoor",
  "description": "Rbot (widely cataloged across vendor telemetry as Backdoor:Win32/Rbot, W32.Spybot, Worm:Win32/Rbot, and RxBot) is one of the most prolific and historically significant modular IRC botnet frameworks in cybersecurity history. Active since 2003 following public leaks of its modular C++ source code, Rbot spawned thousands of customized variants across underground hacking networks. Designed as a versatile multi-tool for unauthorized network exploitation, Rbot combines an autonomous worm propagation engine, a backdoor listener, and distributed denial-of-service (DDoS) capabilities. It spreads autonomously across local subnets and external IP ranges by scanning and weaponizing legacy Windows RPC, NetBIOS, and SMB vulnerabilities (such as MS04-011 and MS08-067) alongside dictionary-based password brute forcing. Once installed, Rbot copies itself to the Windows System32 directory, registers Registry Run autostart keys, and connects to hardcoded IRC servers. Botmasters issue commands over password-protected IRC channels to coordinate SYN/UDP packet floods, log keystrokes, harvest CD keys and credentials, and stage secondary malware binaries.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Rbot",
    "W32.Spybot",
    "Worm:Win32/Rbot",
    "Trojan.Win32.Rbot",
    "Win32/Rbot",
    "RxBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Backdoor:Win32/Rbot family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rbot (RxBot) is a classic open-source modular IRC botnet agent and worm capable of DDoS attacks, SMB scanning, and remote execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rbot propagate across network environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans networks for unpatched Windows SMB/RPC vulnerabilities (like MS08-067 and MS04-011) and executes SMB password brute-forcing."
      }
    },
    {
      "@type": "Question",
      "name": "What command-and-control protocol does Rbot use?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rbot communicates with botmasters via Internet Relay Chat (IRC) protocol channels, typically on TCP port 6667 or custom ports."
      }
    },
    {
      "@type": "Question",
      "name": "What malicious tasks do Rbot bots execute on infected hosts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They execute denial-of-service floods (SYN, UDP, HTTP), capture keystrokes, steal software product keys, and download payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can network administrators defend against Rbot infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block outbound IRC port 6667 at perimeter firewalls, patch Windows SMB services, and enforce strong network share authentication."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1110.001",
    "T1498",
    "T1210",
    "T1091",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected host to stop aggressive outbound SMB port scanning and lateral propagation across the subnet.",
    "Block outbound IRC communications (TCP port 6667 and dynamic IRC ports) at the corporate perimeter firewall.",
    "Verify that all Windows hosts on the network are fully patched against legacy remote execution vulnerabilities (e.g., MS08-067).",
    "Force credential resets for all accounts authenticated on the compromised machine and audit network shares for dropped binaries."
  ],
  "what_to_avoid": [
    "Do not allow infected systems to remain networked during investigation, as Rbot continuously probes other subnet endpoints.",
    "Avoid relying solely on file removal without auditing system services, as spawned memory threads will quickly reinstall dropped files."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise Networks",
    "Legacy Infrastructure"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "IRC Botnet Operators"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "lateral_movement",
    "persistence",
    "command_and_control"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2003,
  "lineage": {
    "derived_from": [
      "SDBot Codebase",
      "Classic IRC Botnets"
    ],
    "variants": [
      "RxBot",
      "Spybot",
      "Rbot.gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f",
      "8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a"
    ],
    "delivery": [
      "Network propagation exploiting Windows SMB/RPC vulnerabilities",
      "Network share brute forcing and infected peer-to-peer downloads"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemConfig",
      "Windows System32 dropped executable"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/Rbot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Rbot"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - WORM_RBOT.GEN",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_rbot.gen"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}