{
  "family": "rozena",
  "sample_count": 75,
  "category": "backdoor",
  "description": "Rozena (cataloged across threat research publications and antimalware engines under detections including Backdoor:Win32/Rozena, Trojan.Win32.ROZENA, and Backdoor.Rozena) is a stealthy Windows backdoor and fileless threat loader first documented in 2015. Rozena gained widespread prominence for its integration into targeted spearphishing campaigns weaponized with Microsoft Office exploits (such as CVE-2017-0199 and the Follina MSDT flaw CVE-2022-30190) as well as abuse of legitimate cloud channels like Discord. Once launched, Rozena leverages obfuscated PowerShell loader scripts (including modular injector and decoder routines) to perform memory-resident code injection directly into trusted Windows processes such as wordpad.exe or svchost.exe. It establishes an encrypted reverse shell connecting back to remote C2 infrastructure, allowing attackers to spawn interactive cmd.exe command prompts, execute reconnaissance utilities, and download secondary payloads while evading traditional file-based antivirus scanners.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Rozena",
    "Trojan.Win32.ROZENA",
    "Backdoor.Rozena",
    "Trojan:Win32/Rozena"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Rozena backdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rozena is a stealthy Windows backdoor and fileless loader that injects reverse shells into legitimate system processes."
      }
    },
    {
      "@type": "Question",
      "name": "How is Rozena typically delivered to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via spearphishing emails exploiting Microsoft Office vulnerabilities such as CVE-2017-0199 and Follina (CVE-2022-30190)."
      }
    },
    {
      "@type": "Question",
      "name": "What fileless execution techniques are used by Rozena?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses heavily obfuscated PowerShell scripts to inject shellcode directly into wordpad.exe or svchost.exe memory."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Rozena provide to remote attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides an interactive reverse shell, command execution, local file exfiltration, and secondary payload staging."
      }
    },
    {
      "@type": "Question",
      "name": "How should enterprise security teams mitigate Rozena?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Patch Office/MSDT vulnerabilities, monitor PowerShell script-block logging, and detect unauthorized cross-process memory injection."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.001",
    "T1055.001",
    "T1566.001",
    "T1547.001",
    "T1082",
    "T1071.001",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Rozena payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Rozena persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Cyber Espionage & Unauthorized Remote Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Emails with Weaponized Office Documents",
    "Exploitation of CVE-2017-0199 and Follina (CVE-2022-30190)",
    "Discord CDN Abusive Hosting"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "PowerShell In-Memory Shellcode Injection",
    "Interactive Reverse Shell Execution",
    "Process Injection into wordpad.exe",
    "Secondary Payload Retrieval",
    "System Reconnaissance"
  ],
  "technical_analysis": {
    "file_types": [
      "PowerShell Script (.ps1)",
      "Office Document (.docx/.docm)",
      "Win32 PE Executable"
    ],
    "network_signatures": [
      "Outbound reverse TCP shell connections over non-standard high ports",
      "HTTPS requests retrieving payloads from Discord CDN attachments"
    ],
    "evasion_techniques": [
      "Fileless PowerShell memory injection leaving no disk binary",
      "Hollowing trusted Windows processes like wordpad.exe"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RozenaBackdoor",
      "Scheduled PowerShell startup scripts"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Total remote command execution, enterprise network lateral movement, confidential file theft"
  },
  "lineage": {
    "derived_from": [
      "PowerShell Memory Injection Backdoors"
    ],
    "variants": [
      "Rozena.A",
      "Rozena.PS1"
    ]
  },
  "iocs": {
    "file_hashes": [
      "a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6",
      "b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7"
    ],
    "delivery": [
      "invoice_doc.docx",
      "payload_script.ps1"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsRozena",
      "%AppData%\\Rozena\\rozena_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.ROZENA",
      "url": "https://www.trendmicro.com"
    },
    {
      "name": "Fortinet Threat Research - Analyzing Follina Vulnerability and Rozena Delivery",
      "url": "https://www.fortinet.com/blog/threat-research"
    }
  ]
}