{
  "family": "bifrost",
  "sample_count": 5,
  "category": "trojan",
  "description": "Backdoor:Win32/Bifrost (also known as Bifrose) is an extremely famous, classic Remote Access Trojan (RAT) that emerged in the early 2000s and became a foundational tool in the malware ecosystem. Bifrost provided threat actors with an unprecedented level of interactive, GUI-based control over a compromised machine, allowing them to steal credentials, log keystrokes, view the victim's webcam, and establish a persistent backdoor for further exploitation.<br><br><b>Understanding the Bifrost RAT</b><br>To an end-user, a Bifrost infection might result in the mouse moving on its own, the webcam light activating, or a sudden loss of account access. For a security analyst, Bifrost is a legendary tool. While its original source code is old, derivatives and modified versions of the Bifrost builder have circulated the dark web for decades, making it a persistent threat utilized by script kiddies and sophisticated actors alike.<br><br><b>Execution and Interactive Control Mechanics</b><br>Bifrost is typically delivered via malicious attachments, exploit kits, or bundled with pirated software (`T1204.002`). Upon execution, the payload (often disguised as a legitimate Windows executable or DLL) drops itself into the `System32` directory and establishes persistence via the Registry Run keys or by creating a hidden service (`T1543.003`). Bifrost utilizes process injection (`T1055`) to hide its core operations within legitimate processes like `explorer.exe`. Once connected to the attacker's C2 server, it offers a vast array of capabilities: a powerful keylogger (`T1056.001`), remote desktop viewing/control (`T1078`), a file manager to silently exfiltrate or upload data, and a remote command shell (`T1059`). Bifrost is particularly notorious for its early use of advanced rootkit-like techniques to hide its process and network ports from local monitoring tools.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and severe privacy invasion. Host-based IoCs include EDR alerts for known Bifrost registry modifications (e.g., keys under `HKLM\\Software\\Bifrost`), anomalous child processes spawning from `explorer.exe`, and the presence of heavily obfuscated configuration files in the Windows directory. Network IoCs include consistent, interactive outbound traffic on non-standard ports to Dynamic DNS (DDNS) providers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1055",
    "T1056.001",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected endpoint from the network to sever the attacker's interactive Remote Desktop or Command Shell session.",
    "Assume all local credentials, browser passwords, and typed data have been compromised and mandate immediate password resets.",
    "Perform a deep memory forensics analysis to extract the Bifrost payload and identify the specific DDNS address used for its Command and Control infrastructure.",
    "Wipe and reimage the machine completely; Bifrost's deep hooks make manual removal highly unreliable."
  ],
  "what_to_avoid": [
    "Do not attempt to 'observe' the attacker while the machine is connected to the corporate network, as they can rapidly deploy lateral movement tools via the RAT.",
    "Avoid relying on standard task managers to identify the process, as Bifrost incorporates evasion techniques specifically designed to hide from local scrutiny."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}