T1125: Video/Audio Capture
Operational Executive Summary
T1125 (Video/Audio Capture) is classified under the Collection tactic within the MITRE ATT&CK framework. Adversary tradecraft focused on gathering sensitive files, keystrokes, screen captures, audio, and database records prior to exfiltration. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 42 distinct malware families, totaling over 44,620 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Video/Audio Capture to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Video/Audio Capture, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1125 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Video/Audio Capture to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1125/.
Detection Engineering & Threat Hunting
Detecting Video/Audio Capture requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1125 (Video/Audio Capture) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Video/Audio Capture across adjacent network segments.
Cataloged Malware Families Utilizing T1125 (42 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1125 (Video/Audio Capture):
42 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| xtrat | Rat | 35,969 | Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originall... |
| bladabindi | Rat | 3,930 | Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an i... |
| nanocore | Rat | 2,400 | NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great ... |
| darkkomet | Rat | 801 | DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) original... |
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| poison | Rat | 261 | Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cybe... |
| remcos | Rat | 198 | Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer ... |
| hupigon | Rat | 146 | Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (R... |
| spygate | Rat | 127 | Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in ... |
| predator | Spyware | 120 | Predator is a premier commercial zero-day mercenary spyware platform engineered by Cytrox (part of the European surveillance consortium known as the Intellexa A... |
| ardamax | Infostealer | 114 | PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring s... |
| netwiredrc | Rat | 72 | Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially... |
| orcus | Backdoor | 66 | Orcus RAT (cataloged across security vendors and threat intelligence databases as Backdoor:Win32/Orcus, MSIL/Orcus, and Orcus RAT) is a notorious, modular .NET ... |
| turkojan | Rat | 13 | Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its ... |
| cybergate | Rat | 7 | Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ... |
| adwind | Trojan | 6 | Adwind (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwind, Trojan.Win32.Adwind, and Win32/Adwind) is a multi-stage tr... |
| imminent | Trojan | 6 | Backdoor:Win32/Imminent (specifically, the **Imminent Monitor RAT**) was a highly sophisticated, commercially available Remote Access Trojan. Before its infrast... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| finfish | Advanced Threat | 3 | Spyware:Win32/Finfish (also known as FinFisher or FinSpy) is an incredibly sophisticated, commercial-grade spyware suite. Developed by the German company Gamma ... |
| carbanak | Banking Trojan | 2 | Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware fram... |
| amdocssims | Trojan | 1 | Amdocssims (classified in antivirus detection telemetry under designations including Trojan:Win32/Amdocssims, Trojan.Win32.Amdocssims, and Win32/Amdocssims) is ... |
| atomicrat | Backdoor | 1 | Atomicrat (classified in antivirus detection telemetry under designations including Backdoor:Win32/Atomicrat, Backdoor.Win32.Atomicrat, and Win32/Atomicrat) is ... |
| babel | Ransomware | 1 | Babel (classified in antivirus detection telemetry under designations including Ransom:Win32/Babel, Ransom.Win32.Babel, and Win32/Babel) is a crypto-ransomware ... |
| commandcam | Trojan | 1 | <h3>Executive Summary</h3> CommandCam is a specialized command-line utility designed to silently capture images from a connected webcam. While it has legitimate... |
| ghost | Rat | 1 | Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the C... |
| orcusrat | Ransomware | 1 | <h3>Executive Summary</h3> Orcus RAT is a highly sophisticated, commercially available Remote Access Trojan (RAT). It is controversially marketed and sold on su... |
| orcusrot | Backdoor | 1 | Backdoor:Win32/Orcusrot is a detection name associated with variants or heavily customized builds of the 'Orcus RAT'. Originally marketed as a 'Remote Administr... |
| remoxec | Trojan | 1 | <h3>Executive Summary</h3> Remoxec is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows work... |
| revengerat | Ransomware | 1 | <h3>Executive Summary</h3> RevengeRAT is a highly capable, commercially available Remote Access Trojan (RAT) sold on underground cybercrime forums. It provides ... |
| scarcruft | Trojan | 1 | <h3>Executive Summary</h3> ScarCruft (also known widely as APT37, Reaper, or Group123) is a highly capable, state-sponsored Advanced Persistent Threat (APT) gro... |
| shark | Ransomware | 1 | <h3>Executive Summary</h3> Shark is a versatile and widely distributed Remote Access Trojan (RAT) family. Originating from underground hacker forums, it is desi... |
| spynet | Ransomware | 1 | <h3>Executive Summary</h3> Spy-Net (often detected simply as SpyNet) is a classic, widely available Remote Access Trojan (RAT) that has been in circulation for ... |
| superspy | Advanced Threat | 1 | <h3>Executive Summary</h3> SuperSpy is a classification for a category of commercial or highly aggressive Spyware and Keylogging tools. While occasionally marke... |
| tear | Trojan | 1 | <h3>Executive Summary</h3> Tear is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows worksta... |
| yuri | Trojan | 1 | <h3>Executive Summary</h3> Yuri is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows worksta... |
| bandook | Rat | Sampled | Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software au... |
| beast | Rat | Sampled | Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95... |
| lost_door | Rat | Sampled | Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Acce... |
| nuclear_rat | Rat | Sampled | Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Acce... |
| stream_rat | Trojan | Sampled | Stream-RAT (also styled across security documentation as StreamRAT, Backdoor.StreamRAT, and Trojan.StreamRAT) is an early-to-mid 2000s Remote Access Trojan engi... |
| subseven | Trojan | Sampled | SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojan... |
| synrat | Trojan | Sampled | SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Ac... |