{
  "family": "soldier",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nSoldier is a sophisticated Trojan and custom backdoor frequently associated with targeted espionage operations and Advanced Persistent Threat (APT) groups. It is designed for long-term persistence, covert data exfiltration, and facilitating deep lateral movement within high-value corporate or government networks. Unlike \"smash-and-grab\" ransomware, Soldier is engineered to remain undetected for months, quietly siphoning sensitive intellectual property or strategic communications.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSoldier is typically deployed via highly targeted spear-phishing campaigns tailored to specific individuals within an organization (whaling). The payloads often utilize zero-day exploits or advanced malicious macros embedded in contextually relevant documents.\n\nOnce active, it exhibits advanced tradecraft:\n<ul>\n<li><strong>Custom C2 Protocols:</strong> Rather than using standard HTTP for Command and Control (C2), Soldier often utilizes custom, encrypted protocols or abuses legitimate cloud services to blend its exfiltration traffic with normal corporate network activity.</li>\n<li><strong>Modular Architecture:</strong> The backdoor is modular. The APT operators can dynamically load specific plugins into memory to perform tasks such as keylogging, screen capturing, credential dumping (via Mimikatz), or network scanning, without writing these tools to the hard drive.</li>\n<li><strong>Defense Evasion:</strong> Soldier utilizes advanced techniques like Process Doppelgänging or DLL Side-Loading to execute its malicious code under the guise of signed, legitimate Windows binaries, making it extremely difficult for traditional AV to detect.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Soldier detection is an active crisis. It indicates that a highly skilled, likely state-sponsored or top-tier criminal organization has deeply compromised the network. The primary threat is the catastrophic loss of confidential data, intellectual property, and trade secrets.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Do Not Immediately Isolate (Observe first):</strong> In an APT scenario, immediately isolating the machine may tip off the attackers. Engage a specialized Incident Response (IR) firm immediately to monitor the C2 traffic and identify the full scope of the breach.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Assume the initial endpoint is just a beachhead. IR teams must hunt through Active Directory logs, firewall telemetry, and EDR data to identify all other compromised machines and compromised service accounts.</li>\n<li><strong>Coordinated Eradication:</strong> Remediation requires a coordinated, enterprise-wide \"burn down\" of the attacker's infrastructure. This involves simultaneously wiping all infected machines, globally rotating all credentials, and severing all identified C2 connections at once.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Soldier",
    "Backdoor.APT.Soldier",
    "Win32/Soldier"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071",
    "T1574.002",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:38:22Z",
  "type": "Trojan / APT Backdoor",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}