{
  "family": "turkojan",
  "sample_count": 13,
  "category": "rat",
  "description": "Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its aggressive system manipulation tools and extensive use in cybercrime and extortion campaigns. Structured with a server-client architecture, Turkojan allows operators to take complete GUI-based control over compromised Windows endpoints—including webcam recording, audio eavesdropping, keystroke logging, credential harvesting, registry tampering, and hardware disruption. The author of Turkojan was apprehended following a coordinated cybercrime crackdown, solidifying Turkojan's place as a foundational precursor to modern commodity remote access malware.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Turkojan",
    "Turkojan RAT",
    "Backdoor:Win32/Turkojan",
    "Turkojan 4",
    "Trojan.Turkojan",
    "Win32/Turkojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Turkojan RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Turkojan is a historic Turkish Remote Access Trojan that provides complete administrative control, surveillance, and credential theft."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Turkojan feature?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Turkojan can capture webcam video, record microphone audio, log keystrokes, and scrape stored browser and FTP passwords."
      }
    },
    {
      "@type": "Question",
      "name": "How does Turkojan hide on compromised systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Turkojan uses process injection techniques (often into explorer.exe) to conceal its running modules and open network listening ports."
      }
    },
    {
      "@type": "Question",
      "name": "How was Turkojan distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Turkojan was distributed through P2P file networks, trojanized video game files, and email attachments."
      }
    },
    {
      "@type": "Question",
      "name": "What legal action was taken against Turkojan's author?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In a coordinated law enforcement operation, Turkish police and international agencies arrested Turkojan's primary developer in Turkey."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1055",
    "T1059.003",
    "T1547.001",
    "T1071.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2006,
  "lineage": {
    "derived_from": [],
    "variants": [
      "turkojan v1.0",
      "turkojan 4.0 gold",
      "turkojan private build"
    ]
  },
  "attribution": [
    {
      "actor": "Turkish Cybercrime Syndicates & Global Script Kiddies",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2008-2244",
    "CVE-2010-2568"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "HTTP"
    ],
    "ports": [
      80,
      15963,
      8080
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8a",
      "9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b"
    ],
    "delivery": [
      "trojanized_game_files",
      "p2p_file_downloads"
    ],
    "persistence": [
      "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Windows System Directory drops"
    ]
  },
  "sources": [
    {
      "name": "Symantec Security Response: Trojan.Turkojan Analysis",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "Microsoft Security Intelligence: Backdoor:Win32/Turkojan Threat Assessment",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Turkojan"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "containment_steps": [
    "Isolate compromised endpoints to immediately sever interactive attacker control.",
    "Dump system memory to recover the attacker's dynamic DNS C2 server address and port.",
    "Perform a clean operating system reinstall after forensic evidence preservation.",
    "Enforce outbound firewall filtering on non-standard high ports."
  ],
  "what_to_avoid": [
    "Do not allow unmonitored inbound or outbound TCP connections on high ports like 15963.",
    "Avoid running unverified executables downloaded from gaming and hacking message boards.",
    "Never operate endpoints without active endpoint detection and behavioral monitoring."
  ],
  "target_industries": [
    "consumers",
    "gaming",
    "small_business",
    "education"
  ],
  "motivation": "Unauthorized Remote Control, Surreptitious Surveillance & Extortion",
  "threat_actors": [
    "Turkish Cybercrime Syndicates"
  ],
  "target_geographies": [
    "TR",
    "US",
    "DE",
    "FR",
    "GB",
    "BR",
    "IT"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}