{
  "family": "scarsi",
  "sample_count": 133,
  "category": "backdoor",
  "description": "Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access Trojan (RAT) and persistent backdoor active since 2012. Engineered to facilitate covert corporate infiltration and interactive endpoint surveillance, Scarsi is typically distributed via spearphishing emails containing malicious document attachments or delivered as a secondary payload by web exploit kits. Upon execution, the malware unpacks its heavily obfuscated core binary, drops randomized executables into %APPDATA% or %TEMP% directories, and secures autostart persistence through Windows Registry Run keys (HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) and hidden scheduled tasks. To evade endpoint detection and bypass host intrusion prevention systems, Scarsi injects its communication modules into legitimate Windows system processes (such as svchost.exe). Once embedded, Scarsi initiates encrypted command-and-control beaconing, providing remote threat actors with interactive command shell access, system profiling, keystroke monitoring, arbitrary file upload/download, and network pivoting capabilities.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Scarsi",
    "Trojan:Win32/Scarsi",
    "Win32/Scarsi",
    "Trojan.Scarsi",
    "Backdoor.Scarsi"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Scarsi backdoor family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Scarsi is a stealthy Windows Remote Access Trojan (RAT) that grants attackers interactive remote control over compromised systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scarsi arrive on victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through spearphishing emails with malicious attachments and drive-by web exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "How does Scarsi conceal its presence in memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects its backdoor communication modules into legitimate Windows processes such as svchost.exe."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Scarsi provide to remote attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enables interactive command execution, system profiling, file uploading and downloading, and keystroke logging."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise respond to a Scarsi compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate injected processes, block C2 network endpoints, and perform a comprehensive credential reset."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2012,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Win32 Remote Access Trojan Architecture",
      "Process Hollowing Backdoor Framework"
    ],
    "variants": [
      "Scarsi.A",
      "Scarsi.B",
      "Scarsi.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1055",
    "T1547.001",
    "T1053.005",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the corporate network immediately to terminate the attacker's active backdoor session.",
    "Perform volatile memory analysis using EDR to identify and terminate hollowed or injected svchost.exe processes.",
    "Delete persistent scheduled tasks and registry keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Block identified C2 IP addresses and domains at the perimeter firewall, and rotate credentials for all compromised accounts."
  ],
  "what_to_avoid": [
    "Do not allow the infected host to remain connected to the corporate LAN while investigating.",
    "Avoid opening macro-enabled attachments from unverified external senders."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Information Technology",
    "Manufacturing"
  ],
  "threat_actors": [
    "Unknown / Cyber Espionage Group"
  ],
  "target_geographies": [
    "Global",
    "Europe",
    "North America"
  ],
  "attack_stage": [
    "command_and_control",
    "remote_access",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "iocs": {
    "file_hashes": [
      "d9f1a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1",
      "e0b2d4f6a8b0c2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4c6e8b0d2f4a6c8e0b2"
    ],
    "delivery": [
      "Targeted spearphishing emails carrying weaponized document droppers",
      "Drive-by browser exploits targeting vulnerable third-party plugins"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Scarsi",
      "%APPDATA%\\Microsoft\\Scarsi\\scarsi.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/Scarsi",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Scarsi"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Scarsi",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}