{
  "family": "rbot",
  "sample_count": 109,
  "category": "backdoor",
  "description": "Backdoor:Win32/Rbot (also known as W32.Spybot) is a classic, highly prolific, and highly customizable IRC-controlled botnet agent and worm historically responsible for massive DDoS attacks, credential theft, and rapid lateral movement across legacy networks.<br><br><b>Understanding Rbot</b><br>To the end-user, an Rbot infection might result in a slightly sluggish PC or sudden network disconnections. For incident responders, Rbot represents a piece of malware history that still surfaces on unpatched, legacy systems. Operating at its peak in the mid-2000s, Rbot's source code was leaked, leading to thousands of variants. It is a 'Swiss Army knife' of malware, combining backdoor capabilities, network scanning, exploitation modules, and DDoS capabilities into a single executable.<br><br><b>Execution and Evasion Strategies</b><br>Rbot primarily propagates by scanning the local network for systems with weak passwords (SMB brute-forcing) or unpatched vulnerabilities (like MS08-067 or MS04-011). Once it breaches a system, it copies its executable to the Windows System directory and establishes persistence via Registry Run keys. It then connects to a hardcoded IRC (Internet Relay Chat) server and joins a specific, often password-protected channel. The botmaster issues commands in the channel, directing the infected swarm to launch SYN floods, steal CD keys (for gaming), capture keystrokes, or download secondary payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and participation in a botnet. Threat hunters should look for anomalous outbound IRC traffic (TCP port 6667 or custom ports) originating from the endpoint. A key indicator of Rbot is massive, continuous outbound scanning on ports 135, 139, and 445 as the bot attempts to aggressively spread laterally. EDR platforms frequently flag Rbot for attempting to exploit known, legacy SMB vulnerabilities.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1110.001",
    "T1498",
    "T1210",
    "T1091"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to sever the connection to the IRC C2 server, halting DDoS participation and lateral movement.",
    "Block outbound IRC traffic (TCP 6667) at the corporate firewall to prevent any infected hosts from receiving commands.",
    "Ensure the endpoint is fully patched; Rbot relies heavily on legacy Windows vulnerabilities (like MS08-067) to propagate.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force a password reset for any accounts associated with the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; Rbot will aggressively attempt to infect every other machine on the subnet.",
    "Avoid relying solely on manual file deletion; the injected processes will instantly recreate the persistence mechanisms."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}