{
  "family": "farfli",
  "sample_count": 360,
  "category": "rat",
  "description": "Trojan:Win32/Farfli is an infamous backdoor trojan family designed to grant remote attackers complete, unauthorized access to compromised Windows environments.<br><br><b>What You Need to Know</b><br>To a layman, Farfli is a silent invader that allows hackers to control a computer as if they were sitting right in front of it. For cybersecurity experts, Farfli represents a critical compromise of endpoint integrity. It is heavily utilized by advanced persistent threat (APT) groups and cybercriminals to establish a reliable beachhead within a corporate network, allowing for subsequent lateral movement and data exfiltration.<br><br><b>Malware TTPs and Architecture</b><br>Farfli is typically delivered via exploit kits, malicious email attachments, or dropped by primary trojans. Upon execution, it achieves persistence by injecting its malicious payload into trusted system processes (like <code>explorer.exe</code> or <code>iexplore.exe</code>) and creating autorun registry keys. The backdoor then opens a clandestine communications channel with its Command and Control (C2) server. <br><br><b>Impact and Incident Response</b><br>Once active, the Farfli backdoor provides a vast array of capabilities to the attacker: it can log keystrokes, capture screenshots, steal saved browser credentials, execute arbitrary shell commands, and download additional modules. Because it operates within the memory space of legitimate processes, it often successfully evades traditional, signature-based endpoint protection. Threat hunters must rely on behavioral analytics, searching for anomalous outbound network connections from standard processes and unexpected changes to system configuration files to detect a Farfli intrusion.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1571",
    "T1056.001",
    "T1113",
    "T1059.003",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from both the internet and the internal network immediately to severe the attacker's interactive backdoor access.",
    "Capture a full forensic memory image of the machine prior to shutdown, as Farfli operates heavily in memory via process injection.",
    "Identify the C2 IP addresses and ports used by Farfli and implement organization-wide blocks at the firewall.",
    "Force a global password reset for any user accounts that logged into the infected machine, as Farfli possesses extensive keylogging capabilities."
  ],
  "what_to_avoid": [
    "Do not leave the endpoint connected to the network during triage; the attacker has active, remote control and may sabotage the system.",
    "Do not rely solely on automated AV removal, as Farfli's deep system hooks often require manual forensic remediation or a complete OS rebuild."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}