Skip to content
Syn_OS Phoenix Syn_OS

Backdoor

Risk Level

Introduction

Section titled “Introduction”

A backdoor is a method of bypassing normal authentication to gain remote access to a system. Backdoors are the primary goal of most malware — once installed, they provide persistent, stealthy access for command execution, data exfiltration, and lateral movement.

History

Section titled “History”
MilestoneYearDetails
Back Orifice1998First Windows RAT; cDc
SubSeven1999Popular script-kiddie RAT
NetBus1998Early Windows RAT
PoisonIvy2005RAT used by APTs
Gh0st RAT2008Chinese APT staple
PlugX / Korplug2012+APT10, APT41
Cobalt Strike2012+Legitimate tool, abused
Sliver / Mythic2020+Modern C2 frameworks

Backdoor Types

Section titled “Backdoor Types”
TypeDescriptionExamples
Remote Access Trojan (RAT)Full interactive controlGh0st, PlugX, njRAT
Web ShellBrowser-based command execChina Chopper, WSO
SSH BackdoorAuthorized keys, PAMauthorized_keys inject
Scheduled TaskPersistence via tasksschtasks, cron
Registry Run KeysRun, RunOnce, servicesHKCU\Run, HKLM\Run
WMI Event SubscriptionWin32_ProcessStartTraceWMI permanent consumers
DLL Search Order HijackLegitimate app loads malicious DLLversion.dll in app dir
Port KnockingHidden port activationfwknop, custom

C2 Channels

Section titled “C2 Channels”
ChannelCovert?Examples
HTTP/HTTPSLowStandard web traffic
DNSMediumDNSCat2, iodine
ICMPMediumPing tunnels
TCP/UDP rawLowCustom protocols
Social MediaHighTwitter, GitHub, Slack
BlockchainHighMemo.cash, OP_RETURN
EmailMediumSMTP/IMAP C2

Notable Backdoors

Section titled “Notable Backdoors”
BackdoorYearAttributionNotable
Back Orifice1998cDcFirst Windows RAT
Gh0st RAT2008Chinese APTOpen source, widely used
PlugX2012+APT10/41Modular, plugin-based
Cobalt Strike2012+Red TeamBeacon, Malleable C2
Sunburst2020SVR (SolarWinds)Supply chain
Sliver2020+Bishop FoxModern, cross-platform

Detection

Section titled “Detection”
IndicatorDetection
Unusual outbound connectionsNetFlow, Zeek, firewall logs
Unusual process treesEDR process tree analysis
Persistence mechanismsautoruns, sysinternals, WMI
Unsigned driversDriver signature enforcement
Beaconing patternsRegular intervals, jitter analysis

Prevention

Section titled “Prevention”
  • ✅ Application whitelisting — Only signed, approved binaries
  • ✅ EDR with behavioural detection — Process trees, network
  • ✅ Network segmentation — Limit lateral C2
  • ✅ DNS filtering — Block known malicious domains
  • ✅ Audit persistence locations — autoruns, scheduled tasks
  • ✅ Application control — WDAC, AppLocker
  • ✅ Zero Trust — Verify every connection

MITRE ATT&CK

Section titled “MITRE ATT&CK”
TechniqueIDDescription
Remote Access SoftwareT1219RAT installation
Web ShellT1505.003Web server backdoor
Scheduled TaskT1053.005Persistence via tasks
Valid AccountsT1078Credential reuse
Protocol TunnelingT1572Encapsulated C2
Section titled “Related”