{
  "family": "arcdoor",
  "sample_count": 4,
  "category": "trojan",
  "description": "Backdoor:Win32/Arcdoor is a persistent, stealthy backdoor trojan designed to provide remote attackers with interactive, unauthorized access to a compromised endpoint. Once installed, it acts as a silent conduit, allowing threat actors to exfiltrate data, monitor user activity, and deploy further malicious modules at will.<br><br><b>Understanding Arcdoor</b><br>To an end-user, an Arcdoor infection is completely invisible; there are no pop-ups, ransom notes, or obvious system slowdowns. For a security analyst, a backdoor like Arcdoor represents a critical, ongoing breach of the network. It means an attacker has established a beachhead and can bypass perimeter security controls (like firewalls) by maintaining an outbound, reverse-shell connection to their Command and Control (C2) infrastructure.<br><br><b>Execution and Command Mechanics</b><br>Arcdoor is typically deployed as a secondary payload by an initial access broker, or via targeted spear-phishing (`T1566.001`). Upon execution, it establishes deep persistence, often by creating a hidden Windows Service (`T1543.003`) or modifying the `Winlogon` registry keys (`T1547.004`). It injects its core code into legitimate system processes like `svchost.exe` or `explorer.exe` (`T1055`) to camouflage its network activity. Arcdoor then initiates a covert beacon out to its C2 server, often using encrypted HTTP/HTTPS traffic or custom protocols over non-standard ports (`T1071.001`). Once a connection is established, the attacker has full remote control, capable of executing arbitrary shell commands (`T1059.003`), uploading/downloading files, and taking screenshots.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity on the compromised host, often leading to lateral movement across the enterprise. Host-based IoCs include EDR alerts for 'Suspicious Process Hollowing', anomalous outbound network connections originating from `svchost.exe` (especially to unknown IP addresses without corresponding DNS requests), and the creation of unexpected Windows Services.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1071.001",
    "T1059.003",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hiding in legitimate processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to sever the active attacker connection and prevent lateral movement.",
    "Analyze the memory of the running `svchost.exe` processes to identify the injected Arcdoor module and extract the C2 IP addresses/domains.",
    "Block the identified C2 infrastructure at the corporate firewall and proxy, and hunt across the network for other endpoints communicating with those IPs.",
    "Assume all credentials present on the infected machine have been compromised and initiate enterprise-wide password resets."
  ],
  "what_to_avoid": [
    "Do not simply run a file-based AV scan and leave the machine online; backdoors often update themselves or deploy rootkits, requiring a full wipe and reimage.",
    "Avoid investigating the endpoint on the live network, as the attacker may notice the investigation and deploy destructive wipers to cover their tracks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}