{
  "family": "recam",
  "sample_count": 30,
  "category": "rat",
  "description": "Recam (cataloged across threat research repositories under signatures including Backdoor:Win32/Recam, Trojan:Win32/Recam, and Backdoor.Recam) is a stealthy Windows remote access trojan and surveillance backdoor active since 2012. Delivered primarily through targeted spear-phishing emails containing malicious office documents and bundled software installers, Recam is engineered to provide persistent remote administration and espionage capabilities on compromised endpoints. Upon installation, Recam registers autostart services or writes to the Windows CurrentVersion\\Run registry key to ensure persistence across system reboots. It establishes outbound TCP connections to remote threat actor command-and-control servers using custom binary protocols, granting attackers interactive command-line shell access, real-time desktop screen capture, webcam video recording, microphone audio surveillance, keystroke logging, and arbitrary file upload/download capabilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Recam",
    "Trojan:Win32/Recam",
    "Win32/Recam",
    "Backdoor.Recam",
    "Backdoor:Win32/Recam.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Recam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Recam is a Windows remote access trojan (RAT) that enables attackers to control systems remotely, record webcams, and log keystrokes."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features are included in Recam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Recam features webcam video streaming, microphone audio recording, live desktop screenshots, keystroke logging, and remote shell execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Recam maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers background Windows services or creates autorun values in the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers distribute Recam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers distribute Recam through spear-phishing emails with malicious attachments and trojanized utility software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations detect Recam activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for anomalous outbound TCP connections on non-standard ports, detect unauthorized service creations, and inspect webcam API hooks."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1113",
    "T1125",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spear-Phishing Emails with Malicious Documents",
    "Trojanized Software Installers",
    "Drive-by Download Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Webcam & Microphone Audio Surveillance",
    "Real-Time Desktop Screen Capture",
    "Keystroke Logging & Clipboard Scraping",
    "Remote Interactive Command Shell",
    "Arbitrary File Upload and Download"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound TCP connections to remote C2 IP addresses on non-standard ports transmitting zlib-compressed surveillance data",
      "Periodic heartbeat beacons containing computer name, active window title, and user privileges"
    ],
    "evasion_techniques": [
      "Injecting backdoor surveillance threads into trusted processes like svchost.exe",
      "Dynamic API resolution via PEB hash lookups to conceal multimedia capture APIs"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5",
      "26d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RecamSvc",
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\RecamBackdoor"
    ],
    "file_paths": [
      "%AppData%\\Recam\\recam_client.exe",
      "%Temp%\\cam_capture.tmp",
      "%LocalAppdata%\\Temp\\log.dat"
    ]
  },
  "defensive_measures": [
    "Deploy EDR to monitor and restrict unauthorized processes accessing video capture and audio recording hardware APIs",
    "Inspect perimeter firewall logs for persistent, non-standard outbound TCP connections",
    "Enforce application control policies to block unauthorized binaries executing from user directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Recam",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Recam"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Recam",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:Win32/Recam.A",
      "Backdoor:Win32/Recam.B"
    ]
  },
  "motivation": "Surveillance, Espionage & Interactive Remote Administration",
  "sample_hashes": []
}