Netwire
Overview
Executive Summary
NetWire is a sophisticated, commercially available Remote Access Trojan (RAT) that has been active since at least 2012. Marketed ostensibly as a legitimate remote administration tool, its robust keylogging, credential theft, and cross-platform capabilities (targeting Windows, Linux, and macOS) have made it highly popular among cybercriminals and Advanced Persistent Threat (APT) groups. It is utilized post-compromise to establish stealthy persistence, exfiltrate sensitive data, and pivot within corporate networks.Infection Vector and Technical Capabilities
NetWire is overwhelmingly distributed via targeted spear-phishing campaigns. Attackers utilize malicious Microsoft Office documents containing weaponized macros or exploit known vulnerabilities (like CVE-2017-11882 in Equation Editor) to silently download and execute the RAT payload. Once active, NetWire provides extensive, interactive control over the victim machine:- Advanced Keylogging & Credential Theft: NetWire is renowned for its highly effective, custom-built keylogger. It also systematically searches the file system for browser profiles, email client databases (Outlook), and FTP configurations, decrypting and stealing all saved passwords.
- Cross-Platform Capabilities: Uniquely among many commercial RATs, NetWire source code has been compiled to target macOS and Linux environments, allowing attackers to maintain a homogeneous C2 infrastructure while targeting diverse endpoints.
- Remote Control and Evasion: The attacker has full GUI-based control over the file system, can execute arbitrary commands, and view the victim's screen. The RAT uses custom encryption for its C2 communications and often employs process hollowing to evade local AV detection.
Threat Assessment
A NetWire detection is a critical incident indicating a total compromise of the affected endpoint. The attacker has interactive, human-driven access to the machine, is actively capturing credentials, and possesses the capability to move laterally to compromise the broader domain.Incident Response and Remediation
- Immediate Network Severance: The endpoint must be physically disconnected from the network instantly to terminate the attacker's interactive session and halt any ongoing data exfiltration.
- Hunt for Lateral Movement: Because NetWire is heavily utilized for credential theft and espionage, incident responders must assume the attacker has attempted to move laterally. Scrutinize Active Directory logs for compromised credentials.
- Total Re-imaging and Global Credential Reset: The machine is completely untrusted and must be wiped to bare metal. All credentials (user, service accounts, local admins) that were exposed to the compromised machine must be immediately reset.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1071.001 T1056.001 T1055
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
- T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_NETWIRE {
meta:
description = "Detects Netwire (trojan)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "netwire" ascii wide nocase
$s2 = "rat.netwire" ascii wide nocase
$s3 = "backdoor.netwire" ascii wide nocase
$s4 = "win32/netwire" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Netwire Activity
id: 9818f8e3b27945617a1f1d9266e3e5c4
status: experimental
description: Detects generic indicators of the netwire malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*netwire*"
- "*rat.netwire*"
- "*backdoor.netwire*"
- "*win32/netwire*"
condition: selection
level: mediumReferences & External Analysis
- MITRE ATT&CK: NETWIRE (S0198)
- Search "netwire" on VirusTotal (External Analysis)
Frequently Asked Questions
What is NETWIRE?
A publicly available, multiplatform remote administration tool used by criminal and APT groups since at least 2012, frequently abused as a RAT.
Is NETWIRE cross-platform?
Yes; it has variants able to run on multiple operating systems.
What can NETWIRE do?
Remote control, keylogging, and theft of credentials and payment information.
Who uses NETWIRE?
MITRE notes it has been used by both ordinary criminal actors and advanced persistent threat (APT) groups.
How is NETWIRE delivered?
Mainly through phishing emails with malicious attachments.
How do I reduce the risk of RATs like NETWIRE?
Be cautious with attachments and downloads, keep endpoint protection updated, and verify any remote-access software on your machine was installed intentionally.
Where is the authoritative reference?
MITRE ATT&CK's NETWIRE entry (S0198), linked on this page.
How do I remove the Netwire Trojan from Windows?
Manual removal of Netwire is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Netwire a virus or a Trojan?
Netwire is classified as a Trojan. Unlike traditional viruses that infect files, modern malware like Netwire typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Netwire infection?
Symptoms of Netwire can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: trojan)
Explore other malware families in the same category:
Protect Your Network Against Trojans
Want to prevent Netwire and similar threats from compromising your organization? Read our comprehensive defensive guide: Banking Trojan Protection.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/netwire.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.