{
  "family": "y3k_rat",
  "sample_count": 0,
  "category": "trojan",
  "description": "Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visual Basic around 2001. Operating under a classic client-server model, Y3K RAT allowed unauthorized operators to remotely manipulate Windows 9x, ME, and 2000 endpoints over TCP connections. Upon execution, the Y3K server binary installs itself into the Windows System folder, writes autostart entries to the registry Run keys, and listens for inbound administrative sessions. Once connected, attackers were provided with extensive remote surveillance and administrative controls, including real-time desktop screen captures, file system navigation, file upload and download, remote process management, keyboard logging, and hardware tampering routines such as opening CD trays and playing synthesized sounds.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Y3K RAT",
    "Y3K 1.6",
    "Backdoor.Y3K",
    "Trojan.Win32.Y3K",
    "Backdoor:Win32/Y3K"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Y3K remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Y3K RAT is an early-2000s Visual Basic remote access trojan that grants unauthorized remote control and surveillance over Windows hosts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Y3K RAT communicate with attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The server binary opens a listening TCP port on the host, waiting for connections from the operator client application."
      }
    },
    {
      "@type": "Question",
      "name": "What administrative actions could Y3K RAT perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed file transfers, keystroke monitoring, screen captures, process termination, registry editing, and hardware pranks."
      }
    },
    {
      "@type": "Question",
      "name": "How does Y3K RAT maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds startup entries to the Windows registry Run keys and system initialization files like win.ini."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Y3K RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block unexpected listening ports at network firewalls, monitor registry autostart keys, and deploy standard antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2001,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Vintage Win32 RAT Era"
    ],
    "variants": [
      "Y3K 1.0",
      "Y3K 1.6",
      "Y3K Pro"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1083",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network to terminate active attacker sessions.",
    "Kill the Y3K server process using Task Manager or command-line utilities.",
    "Clean malicious entries from the Windows registry Run keys and win.ini files.",
    "Delete the server binary from the Windows System directory and perform a full antivirus scan."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown sources or IRC file exchanges.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3",
      "0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f"
    ],
    "delivery": [
      "Distribution across vintage IRC file sharing channels and P2P networks",
      "Deceptive email attachments disguised as multimedia files or game patches"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Y3KServer",
      "%WINDIR%\\System32\\y3k_sys.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.Y3K",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical RAT Collection - Y3K",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}