Enfal

Overview

Backdoor:Win32/Enfal (also tracked as **Linfo**) is a highly targeted, persistent Remote Access Trojan (RAT) that has been used extensively by sophisticated Chinese state-sponsored APT groups (particularly those targeting government, aerospace, and defense sectors in Southeast Asia and the US). It acts as a primary backdoor to establish a long-term foothold for deep cyber espionage and data exfiltration.

Understanding the Enfal Backdoor
To the victim, the infection is completely invisible. For a threat intelligence analyst, an Enfal detection is a critical national security incident. It signifies that the organization has been breached by a highly skilled nation-state actor. Enfal is notable for its simplicity and reliability; rather than relying on massive exploits, it utilizes stealthy HTTP communication and basic encryption to remain undetected for months or years.

Execution and APT Mechanics
APT groups typically distribute Enfal via highly targeted spearphishing emails (`T1566.001`) containing weaponized Office documents (often exploiting CVE-2012-0158 or similar legacy vulnerabilities). Upon execution, the payload (`T1204.002`) drops the Enfal DLL into the `%SystemRoot%` directory and establishes persistence as a Windows Service (`T1543.003`). Enfal is designed for covert communication (`T1071.001`); it communicates with its Command and Control (C2) server using simple HTTP GET and POST requests, often mimicking legitimate web traffic. The C2 domain is usually hardcoded or generated dynamically. Once connected, the attacker can upload further specialized tools (like credential dumpers), download sensitive files (`T1041`), and execute arbitrary shell commands (`T1059.003`) to move laterally.

Indicators of Compromise & Impact
The impact is the devastating, long-term compromise of intellectual property and state secrets. The primary network IoC is beaconing HTTP traffic (often lacking standard User-Agent strings or using hardcoded, anomalous headers) to unknown or recently registered domains. EDR logs will show the creation of a suspicious Windows Service designed to launch a newly dropped DLL file. Memory analysis is often required to extract the hardcoded C2 infrastructure.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_ENFAL_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Enfal"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "enfal" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Enfal (Trojan) Execution & Triage
id: 0e5a8f7a-7e2e-58cf-864b-d4e32cbbc6ea
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Enfal malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/enfal
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1071_001
- attack.t1041
- attack.t1543_003
- attack.t1566_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_ENFAL_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Enfal tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "enfal" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; an active Enfal infection means a highly skilled nation-state actor is operating within the network.
2. Assume all local credentials and sensitive documents on the machine have been compromised. Enforce immediate password resets.
3. Capture a full memory dump (RAM) and forensic disk image before powering off the machine. The memory dump is crucial to extract the decrypted C2 URLs.
4. Perform a complete bare-metal wipe and reinstall of the operating system; APT actors utilize highly advanced, undocumented persistence mechanisms.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the attack is over if one Enfal instance is quarantined; these actors frequently deploy multiple, redundant backdoors.
2. Avoid tipping off the adversary; coordinate with specialized incident response teams before taking noisy containment actions.

References & External Analysis

• Search "enfal" on VirusTotal (External Analysis)
• Search "enfal" on Any.Run (Sandbox Sandbox)
• Search "enfal" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Fuery
• Ircnite
• Metel
• Jacard
• Winreg
• Ayolog
• Favadd
• Gampass

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/enfal.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.