{
  "family": "sysn",
  "sample_count": 99,
  "category": "trojan",
  "description": "Sysn (cataloged across security intelligence as Trojan:Win32/Sysn, Trojan.Win32.Sysna, and Swisyn) is a resilient family of Delphi-based Windows trojans and payload loaders active since 2011. Characterized by aggressive defense evasion and system modification capabilities, Sysn is distributed via weaponized spearphishing attachments, trojanized key generators, and drive-by web exploit kits. Upon execution on a compromised endpoint, Sysn deploys dynamic API hashing and multi-layered binary packing to evade static signature detection. It systematically impairs host security controls: modifying the Windows Registry to disable the Windows Firewall (DisableFirewall), terminating security monitoring services, and altering the local HOSTS file (C:\\Windows\\System32\\drivers\\etc\\hosts) to redirect antivirus update domains and security vendor websites to loopback (127.0.0.1). Sysn establishes persistence by installing a rogue Windows Service (T1543.003) or modifying Registry Run keys, subsequently initiating encrypted HTTP beaconing to command-and-control servers to download and execute secondary malware payloads including information stealers and banking trojans.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Sysn",
    "Trojan.Win32.Sysn",
    "Trojan.Win32.Sysna",
    "Swisyn",
    "Win32/Sysn"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Sysn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sysn is a Delphi-based Windows trojan and loader that disables firewalls, modifies HOSTS files, and downloads secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sysn impair host defensive tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies registry policies to disable Windows Firewall and alters the local HOSTS file to block security vendor update servers."
      }
    },
    {
      "@type": "Question",
      "name": "What distribution vectors are used by Sysn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is distributed through weaponized email attachments, software cracks, keygens, and exploit kit landing pages."
      }
    },
    {
      "@type": "Question",
      "name": "How does Sysn establish persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs rogue background Windows Services and creates autostart entries under CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "What remediation steps should be taken for a Sysn compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, restore the Windows HOSTS file, reset firewall policies, and run full offline antimalware remediation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1543.003",
    "T1562.001",
    "T1112",
    "T1562.004",
    "T1547.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint from the network to halt C2 communications and secondary malware downloads.",
    "Audit the Windows HOSTS file (C:\\Windows\\System32\\drivers\\etc\\hosts) and remove malicious entries blocking security vendor domains.",
    "Re-enable and reset Windows Firewall policies using 'netsh advfirewall reset' to restore network boundary defenses.",
    "Audit Windows Services using 'sc.exe' and Registry Run keys to identify and delete rogue Sysn service registrations."
  ],
  "what_to_avoid": [
    "Do not trust local endpoint security alerts during triage, as Sysn is specifically designed to tamper with native security logging.",
    "Avoid relying solely on automated file deletion without inspecting the modified system services and firewall configurations."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Enterprise Workstations",
    "Financial Institutions"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "lineage": {
    "derived_from": [
      "Delphi Trojan Dropper Families"
    ],
    "variants": [
      "Sysn.A",
      "Sysna.B",
      "Swisyn Loader"
    ]
  },
  "iocs": {
    "file_hashes": [
      "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b",
      "9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c"
    ],
    "delivery": [
      "Malicious email attachments disguised as business invoices",
      "Trojanized utility keygens and software cracks"
    ],
    "persistence": [
      "Rogue Windows Service in HKLM\\SYSTEM\\CurrentControlSet\\Services",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SysnManager"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Sysn",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Sysn"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan.Win32.Sysna",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Sysna/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}