{
  "family": "hupigon",
  "sample_count": 146,
  "category": "rat",
  "description": "Backdoor:Win32/Hupigon is a classic, highly pervasive Remote Access Trojan (RAT) originating from China, heavily utilized in both amateur cybercrime and early state-sponsored espionage campaigns.<br><br><b>Understanding Hupigon</b><br>To a layman, Hupigon grants a remote attacker complete, terrifying control over their webcam, files, and keyboard. For threat intelligence analysts, Hupigon represents a foundational piece of malware history. Written in Delphi, its source code has been widely modified and distributed across underground forums, resulting in hundreds of thousands of distinct variants. It acts as a full-featured backdoor, offering a graphical interface for the attacker to interact with the victim's machine.<br><br><b>Execution and Evasion Strategies</b><br>Hupigon is delivered via spearphishing attachments, peer-to-peer file sharing networks, or dropped by exploit kits. Upon execution, it drops a randomly named DLL or executable into the <code>%SystemRoot%\\System32</code> directory and creates a registry key for persistence. To evade detection, Hupigon injects its code into legitimate processes like <code>iexplore.exe</code> or <code>svchost.exe</code>. It often uses a secondary process to monitor its own execution, ensuring that if the user terminates the RAT, it immediately restarts.<br><br><b>Indicators of Compromise & Impact</b><br>The capabilities are vast: remote desktop control, webcam hijacking, keylogging, file exfiltration, and audio capture. Incident responders should hunt for anomalous outbound TCP connections to dynamic DNS providers (e.g., No-IP or DynDNS), which Hupigon heavily relies upon for C2. Furthermore, analysts should look for dropped files packed with UPX or ASPack, and unexpected <code>SetWindowsHookEx</code> API calls indicative of active keylogging.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1125",
    "T1571",
    "T1055",
    "T1056.001",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1571",
      "name": "Non-Standard Port",
      "tactic": "Command and Control"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Disconnect the network cable or disable the Wi-Fi adapter immediately; the attacker has active, real-time control over the endpoint.",
    "Image the hard drive for forensic analysis, paying special attention to the `System32` directory for randomly named, recently created DLLs.",
    "Identify the Dynamic DNS domains used for C2 in the network logs and block them at the perimeter firewall.",
    "Perform a clean OS installation; Hupigon's watchdog processes and deep process injections make manual removal highly prone to failure."
  ],
  "what_to_avoid": [
    "Do not attempt to 'fight' the attacker for control of the mouse or keyboard; they have SYSTEM-level access and can simply lock you out.",
    "Avoid accessing any sensitive information on the machine during triage, as the keylogger and screen capture are likely active."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}