{
  "family": "waldek",
  "sample_count": 65,
  "category": "trojan",
  "description": "Waldek (cataloged in antivirus vendor databases and threat intelligence taxonomies under detections including Trojan.Win32.Waldek and Trojan:Win32/Waldek!MSR) is a covert Windows trojan and surveillance backdoor active since 2014. Delivered through bundled freeware installers, torrent file shares, and phishing emails using double-extension naming tricks (e.g., .doc.exe), Waldek deploys multi-stage execution routines to evade endpoint detection. Once active, the trojan establishes persistence by writing autostart values to the Windows registry and dropping hidden payload binaries into system directories. Waldek monitors user activity by capturing keystrokes, recording screenshots, enumerating running applications, and exfiltrating collected data to remote C2 servers over HTTP. Furthermore, it operates as a backdoor loader capable of receiving operator instructions to download and execute secondary malware payloads.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan.Win32.Waldek",
    "Trojan:Win32/Waldek!MSR",
    "Win32/Waldek",
    "Trojan:Win32/Waldek"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan.Win32.Waldek?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Waldek is a Windows trojan and surveillance backdoor that logs keystrokes and stages secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Waldek trick users into executing its binary?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses double-extension filenames such as document.doc.exe or disguises itself as freeware installers."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance features are included in Waldek?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It captures screenshots, logs keyboard inputs, enumerates open application windows, and collects system telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "How does Waldek maintain persistence across system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries to the Windows registry under CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "How do you clean an infected system from Waldek?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disconnect from the network, run an offline antimalware scan with Microsoft Defender, and reset compromised passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1555.004",
      "name": "Credentials from Password Stores: Windows Credential Manager",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the active exfiltration of the harvested credential archives.",
    "Force a global, mandatory password reset for the compromised user, prioritizing corporate VPN access, email accounts, and financial portals.",
    "Capture a full forensic memory image to extract the active Waldek payload and identify the specific C2 infrastructure it is communicating with.",
    "Assume all locally saved passwords have been compromised; perform a clean OS rebuild to ensure the infostealer is completely eradicated."
  ],
  "what_to_avoid": [
    "Do not allow the user to type any passwords or access sensitive portals while the machine is infected, as the infostealer may include keylogging capabilities.",
    "Avoid assuming the threat is contained just by removing the executable; the exfiltrated passwords must be reset globally."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Surveillance & Credential Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Double-Extension Email Attachments (.doc.exe)",
    "Bundled Freeware Downloads",
    "Torrent File Sharing"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Keystroke Logging",
    "Desktop Screenshot Capture",
    "Secondary Payload Downloading",
    "Application Window Monitoring",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons exfiltrating keystroke logs and screenshots",
      "Encrypted C2 keep-alive traffic using custom headers"
    ],
    "evasion_techniques": [
      "Double-extension naming to bypass basic user scrutiny",
      "Dropping components into %AppData% with random names"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WaldekClient",
      "%AppData%\\Waldek\\waldek.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Personal data theft, keystroke logging, desktop surveillance, secondary malware compromise"
  },
  "lineage": {
    "derived_from": [
      "Classic Win32 Spyware & Backdoors"
    ],
    "variants": [
      "Waldek.A",
      "Waldek.MSR"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e",
      "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f"
    ],
    "delivery": [
      "document_scan.doc.exe",
      "waldek_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WaldekService",
      "%AppData%\\Waldek\\waldek_host.exe"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist - Trojan.Win32.Waldek Profile",
      "url": "https://securelist.com"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Waldek",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Waldek"
    }
  ]
}