{
  "family": "hematite",
  "sample_count": 616,
  "category": "trojan_generic",
  "description": "Backdoor:Win32/Hematite is a stealthy, targeted Remote Access Trojan (RAT) often utilized in sustained espionage campaigns to establish deep persistence and exfiltrate sensitive data.<br><br><b>Understanding Hematite</b><br>To an end-user, Hematite operates completely invisibly. For threat intelligence analysts, Hematite represents a highly capable backdoor designed for long-term intelligence gathering. Unlike noisy, commercially available RATs, Hematite is often custom-compiled for specific targets, utilizing advanced obfuscation and encrypted C2 channels to evade detection by standard Endpoint Detection and Response (EDR) solutions.<br><br><b>Execution and Evasion Strategies</b><br>Hematite is typically delivered via highly tailored spearphishing campaigns containing weaponized Office documents or PDF exploits. Upon execution, it drops a malicious DLL into the <code>%SystemRoot%\\System32</code> or <code>%AppData%</code> directories. It establishes persistence by registering itself as a hidden Windows Service or via DLL Search Order Hijacking against legitimate system executables. Hematite communicates with its C2 infrastructure using custom encryption over HTTPS (Port 443) to blend in with normal corporate web traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of Hematite is a total compromise of confidentiality and endpoint control. The attacker can execute arbitrary commands, steal credentials, and pivot laterally across the network. Incident responders should hunt for anomalous, persistent HTTPS connections originating from legitimate processes (like <code>svchost.exe</code>) to unknown or newly registered IP addresses. Memory forensics is critical to extract the decrypted Hematite payload and identify the specific C2 domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1056.001",
    "T1055.001",
    "T1543.003",
    "T1573.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1573.001",
      "name": "Encrypted Channel: Symmetric Cryptography",
      "tactic": "Command and Control"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Hematite payload and its C2 configuration.",
    "Identify the specific C2 IP address and implement immediate blocks at the perimeter firewall and proxy servers.",
    "Perform a clean OS rebuild and force password resets for all accounts that accessed the machine, assuming total endpoint compromise."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on static signatures to detect Hematite, as it is frequently re-packed and obfuscated for each targeted campaign."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}