{
  "family": "bifrose",
  "sample_count": 59,
  "category": "trojan",
  "description": "Backdoor:Win32/Bifrose (also widely known as Bifrost) is a classic, highly resilient, and historically significant Remote Access Trojan (RAT) that provides an attacker with complete, interactive control over a compromised Windows endpoint, including keylogging, file manipulation, and remote shell execution.<br><br><b>Understanding Bifrose (Bifrost)</b><br>To the victim, a Bifrose infection is invisible. For incident responders, Bifrose represents a severe breach. Originally appearing around 2004, it was one of the most prolific RATs of its era, favored by both script kiddies and advanced threat actors. Its source code eventually leaked, leading to countless variants. It is renowned for its stability, small footprint, and its early pioneering of process injection techniques to bypass software firewalls.<br><br><b>Execution and Evasion Strategies</b><br>Bifrose is typically distributed via spearphishing attachments, exploit kits, or P2P networks. Upon execution, the 'server' module (the malware) drops a copy of itself into the `%SystemRoot%` or `%ProgramFiles%` directory, often masquerading as a legitimate Windows executable (e.g., `explorer.exe`). It establishes persistence by modifying the Registry Run keys or `ActiveX` configurations. Crucially, Bifrose injects its core payload into legitimate, network-facing processes like `iexplore.exe` (Internet Explorer) to ensure its outbound C2 communication (often over TCP port 81) bypasses local firewall rules. It includes a built-in keylogger that constantly writes captured strokes to a hidden, encrypted `.dat` file.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and continuous data exfiltration. EDR platforms will trigger heavily on the Process Injection (`T1055`) and the unauthorized Registry modifications (`T1112`). Network logs will reveal sustained, encrypted TCP connections, often to dynamic DNS providers (e.g., No-IP). Threat hunters should search the `%SystemRoot%` for the characteristic, encrypted keylogger files generated by Bifrose.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1056.001",
    "T1055",
    "T1547.001",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session and halt data exfiltration.",
    "Capture a full forensic memory image to extract the active Bifrose payload, its decrypted configuration, and its C2 infrastructure.",
    "Audit the Windows Registry (specifically Run keys and ActiveX configurations) to identify and remove the Bifrose persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or deploy ransomware.",
    "Avoid relying solely on file deletion; Bifrose runs in memory and will recreate deleted files if the injected process is not terminated."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}