{
  "family": "serenity_rat",
  "sample_count": 0,
  "category": "rat",
  "description": "Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in Borland Delphi by the Belgian developer known as 'Killua'. Built with modularity and operator usability in mind, Serenity RAT offered a polished graphical control center for managing infected endpoints simultaneously. The server payload operated stealthily in the background, utilizing multithreaded socket listeners to handle real-time screen capture, remote file transfers, and registry browsing. Serenity RAT featured comprehensive keylogging capabilities with offline buffer storage, process injection, remote shell execution, and hardware enumeration. To maintain persistence, the server wrote autostart keys to the Windows Registry and could inject into explorer.exe. Distributed across underground forums, Serenity RAT droppers leveraged CVE-2010-2568 and CVE-2012-0158.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Serenity RAT",
    "Backdoor.Win32.Serenity",
    "Serenity by Killua",
    "Win32/Serenity.RAT",
    "Trojan.Serenity"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Serenity RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Serenity RAT is a mid-2000s Remote Access Trojan developed by Killua in Belgium featuring a modular client-server management interface."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities did Serenity RAT provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provided multi-threaded remote desktop capture, keystroke recording, process injection, registry editing, and shell access."
      }
    },
    {
      "@type": "Question",
      "name": "How did Serenity RAT maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It created autostart registry entries under CurrentVersion\\Run and could inject into explorer.exe upon boot."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to Serenity RAT delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns distributing retro RAT droppers have leveraged shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How is Serenity RAT eradicated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the host, terminate the malicious process, remove registry startup keys, and perform a full malware signature scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055.002",
    "T1056.001",
    "T1112",
    "T1083",
    "T1547.001",
    "T1071.001",
    "T1105"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1055.002",
      "name": "Process Injection: Portable Executable Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected endpoint from the local network to terminate active C2 control channels.",
    "Inspect explorer.exe and active process trees for injected backdoor DLLs or unmapped memory regions.",
    "Remove persistent startup entries in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Deploy endpoint security tools to scan for and eliminate dropped payloads and registry modifications."
  ],
  "what_to_avoid": [
    "Do not allow unmonitored outbound TCP traffic to dynamic DNS domains commonly used by underground RAT controllers.",
    "Avoid executing unknown executable files downloaded from hobbyist developer forums."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Serenity",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Serenity/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Serenity",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/serenity"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "command_and_control"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2006,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "Delphi RAT Frameworks"
    ],
    "variants": [
      "Serenity RAT v1.0",
      "Serenity RAT v1.2"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
      "1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Exploitation of shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SerenityServer",
      "Startup folder shortcut placed under %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}