{
  "family": "umbra",
  "sample_count": 111,
  "category": "loader",
  "description": "Umbra (cataloged as Umbra Loader, Trojan:Win32/Umbra, and Backdoor:Win32/Umbra) is an underground modular HTTP botnet loader and malware distribution framework active since 2012. Developed in C++ and commercialized across cybercrime forums, Umbra was specifically architected to provide threat actors with reliable initial access staging and automated secondary payload deployment. The loader incorporates advanced evasion modules, including ring3 user-mode API hooking, anti-virtualization routines that inspect BIOS serial numbers and hypervisor artifacts, and a built-in 'Botkill' engine engineered to discover and eliminate rival malware families residing on the compromised host. Once operational, Umbra establishes HTTP-based command-and-control communications, periodically polling operator servers for encoded tasking. It injects downloaded executable payloads directly into legitimate operating system processes—such as explorer.exe or svchost.exe—utilizing process hollowing to evade endpoint file-integrity scanners, while maintaining persistence via obfuscated Windows Scheduled Tasks and Registry Run keys.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Umbra Loader",
    "Trojan:Win32/Umbra",
    "Backdoor:Win32/Umbra",
    "Trojan.Win32.Umbra",
    "Win32/UmbraLoader"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Umbra Loader malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Umbra Loader is a modular C++ HTTP botnet loader designed to bypass defenses, kill rival malware, and drop secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "What is the 'Botkill' feature in Umbra?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Botkill is a competitive routine that scans the host for other malware families and terminates them to maintain exclusive host control."
      }
    },
    {
      "@type": "Question",
      "name": "How does Umbra Loader achieve persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes disguised keys into Registry Run paths and registers scheduled tasks masquerading as legitimate Windows background maintenance."
      }
    },
    {
      "@type": "Question",
      "name": "Which evasion techniques does Umbra implement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It checks for hypervisor artifacts, sandboxes, and debuggers, and uses process hollowing to inject code into legitimate processes."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads does Umbra typically deploy?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Operators utilize Umbra to stage banking trojans, information stealers, ransomware, and commercial remote access tools."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1105",
    "T1547.001",
    "T1053.005",
    "T1027",
    "T1497.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the endpoint from network interfaces to disrupt active HTTP polling and tasking execution.",
    "Collect a memory dump to extract injected payload DLLs and identify decrypted C2 server URLs.",
    "Inspect the Windows Task Scheduler and Registry Run entries for newly created, obfuscated autostart configurations.",
    "Reimage the affected workstation to ensure complete removal of injected hollowed processes and dropped secondary threats."
  ],
  "what_to_avoid": [
    "Do not rely solely on simple file deletion, as injected memory threads will quickly regenerate dropped binary components.",
    "Avoid leaving compromised machines connected during analysis, as operators can issue remote self-destruct or wipe commands."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Financial Services",
    "Enterprise"
  ],
  "motivation": "Payload Delivery",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Underground Botnet Operators"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "lineage": {
    "derived_from": [
      "Custom C++ HTTP Loaders"
    ],
    "variants": [
      "Umbra Loader 1.0",
      "Umbra Botnet v2"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b",
      "8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c"
    ],
    "delivery": [
      "Spearphishing emails with malicious macro attachments",
      "Exploit kit traffic and compromised web redirects"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\UmbraUpdate",
      "Windows Scheduled Task executing dropped loader from %AppData%\\Roaming"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Umbra",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Umbra"
    },
    {
      "name": "ZeroSecurity Threat Research - Umbra Loader Overview",
      "url": "https://zerosecurity.org/threat-intel/umbra-loader"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}