Backdoors & Persistent Implants
Threat Landscape & Operational Overview
Backdoor malware provides remote operators with persistent, unauthorized, and covert access to an infected computer or network. Unlike simple droppers, backdoors include rich command-and-control capabilities—enabling threat actors to execute arbitrary shell commands, upload and download files, manipulate process execution, pivot through internal network segments, and maintain clandestine footholds across system reboots. Backdoors frequently serve as the foundational mechanism for long-term espionage, lateral movement, and final-stage ransomware deployment.
🛡️ Enterprise Incident Response & Hardening Guidance
Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:
→ Open Master Guide: Backdoor & RAT Protection for BusinessesPrimary MITRE ATT&CK Tactics & Techniques
Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:
| ID | Technique | Tactic | Observed Operational Behavior |
|---|---|---|---|
T1059.001 |
PowerShell | Execution | Executes remote commands received from C2 operators via hidden PowerShell engines. |
T1573 |
Encrypted Channel | Command & Control | Encrypted C2 communications using custom SSL/TLS certificates or DNS tunneling. |
T1543.003 |
Windows Service | Persistence | Installs malicious background services to ensure continuous execution with SYSTEM rights. |
T1021.002 |
SMB/Windows Admin Shares | Lateral Movement | Propagates to internal servers and domain controllers using administrative shares. |
T1083 |
File and Directory Discovery | Discovery | Scans local drives and network shares for high-value intellectual property. |
Actively Weaponized Exploits & Vulnerabilities (8 CVEs)
Adversaries deploying backdoors & persistent implants frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:
Citrix ADC & Gateway Directory Traversal Remote Code Execution (Shitrix)
Attributed Payloads: winnti
Zoho ManageEngine Desktop Central Untrusted Deserialization RCE
Attributed Payloads: winnti
Microsoft Office MSCOMCTL.OCX ActiveX TreeView / ListView Buffer Overflow
Attributed Payloads: flux, salgorea
Adobe Acrobat & Reader TIFF Integer Overflow Remote Code Execution
Attributed Payloads: darkhotel
Microsoft Internet Explorer CMarkup Use-After-Free (Operation SnowMan)
Attributed Payloads: darkhotel
Microsoft Windows Shell Shortcut LNK / PIF Code Execution (Stuxnet)
Attributed Payloads: flux
Microsoft Word RTF Parsing Memory Corruption (MS14-017)
Attributed Payloads: salgorea
Microsoft Office / WordPad Remote Code Execution via Malicious OLE Moniker
Attributed Payloads: darkhotel
SOC Incident Containment Checklist
Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:
- Isolate the host at the switch port or firewall layer to sever remote shell access.
- Identify the active listening port or reverse TCP/HTTP outbound connection.
- Extract binary configuration data to identify operator C2 IP addresses and domain infrastructure.
- Review authentication logs for unauthorized lateral movement originating from the infected endpoint.
- Perform comprehensive host re-imaging using verified, clean baseline golden images.
- Do not assume closing firewall ports alone eliminates backdoors with domain persistence.
- Do not trust infected systems without complete re-imaging and firmware integrity checks.
Prominent Malware Families in this Category
Top documented threats ranked by historical prevalence and behavioral signatures:
flux
Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backd...
simbot
Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Tr...
swrort
Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a ...
ipamor
Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) i...
cassiopeia
Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiope...
salgorea
Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a soph...
scarsi
Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a s...
hafen
Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stea...
Complete Directory (61 Families)
Alphabetical index of all tracked malware families cataloged under backdoors & persistent implants:
- accelerator
- adduser
- adodb
- agobot
- amiboide
- arcdoor
- atomicrat
- back_orifice
- bagle
- bang5mai
- beastdoor
- bersek
- bifrose
- buterat
- cassiopeia
- cerbu
- chopper
- darkhotel
- doublefantasy
- flux
- hacdef
- hafen
- himera
- ipamor
- keydoor
- koutodoor
- mytob
- netstream
- noancooe
- oceanlotus
- opanki
- orcus
- orcusrot
- predatorthief
- pterodo
- rbot
- redcap
- removewga
- revenge
- rozena
- rpdpatch
- salgorea
- scarsi
- shadowhammer
- shell
- shodi
- shutdowner
- simbot
- smheist
- swrort
- teamspy
- teamviewer
- tick
- vixenpanda
- vjworm
- werpoapt
- winnti
- winvnc
- xiclog
- younglotus
- zxshell