{
  "family": "ulysses",
  "sample_count": 0,
  "category": "trojan",
  "description": "Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in Visual Basic and Delphi. Engineered during the classic era of client-server backdoors, Ulysses was designed to provide unauthorized operators with administrative control over compromised Windows 9x, ME, and 2000 workstations. Operating over direct TCP connections, Ulysses configures an autostart entry in the Windows registry Run key, binds to a listening server port, and waits for incoming connections from the operator's client software. Once connected, attackers can browse and exfiltrate files, execute arbitrary command shell instructions, enumerate and kill running processes, capture desktop screenshots, and tamper with system configuration settings.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ulysses RAT",
    "Trojan.Ulysses",
    "Backdoor.Win32.Ulysses",
    "Ulysses 1.0",
    "Backdoor:Win32/Ulysses"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Ulysses remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ulysses is an early 2000s Windows remote access trojan that grants unauthorized remote control and monitoring over infected endpoints."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ulysses communicate with threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The server binary opens a listening TCP port on the host, waiting for connections from the operator client application."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can remote operators execute with Ulysses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators can navigate directory structures, download files, execute command line scripts, capture desktop images, and terminate processes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ulysses survive system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable startup references into HKCU and HKLM Software\\Microsoft\\Windows\\CurrentVersion\\Run registry keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Ulysses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint antivirus, monitor registry autostart locations, and block unsolicited inbound TCP connections via network firewalls."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2002,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Early Win32 RAT Era"
    ],
    "variants": [
      "Ulysses 1.0",
      "Ulysses 1.2",
      "Ulysses.Gen"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1083",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network to sever active attacker sessions.",
    "Kill the active Ulysses server process using Task Manager or administrative tools.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the server binary from the Windows System32 directory."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown senders or IRC file exchanges.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d",
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b"
    ],
    "delivery": [
      "Vintage IRC DCC file transfers and peer-to-peer file sharing networks",
      "Malicious email attachments disguised as utility updates or games"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UlyssesBackdoor",
      "%WINDIR%\\System32\\ulysses_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Ulysses",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical Backdoor Archive - Ulysses",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}