{
  "family": "enfal",
  "sample_count": 9,
  "category": "trojan",
  "description": "Backdoor:Win32/Enfal (also tracked as **Linfo**) is a highly targeted, persistent Remote Access Trojan (RAT) that has been used extensively by sophisticated Chinese state-sponsored APT groups (particularly those targeting government, aerospace, and defense sectors in Southeast Asia and the US). It acts as a primary backdoor to establish a long-term foothold for deep cyber espionage and data exfiltration.<br><br><b>Understanding the Enfal Backdoor</b><br>To the victim, the infection is completely invisible. For a threat intelligence analyst, an Enfal detection is a critical national security incident. It signifies that the organization has been breached by a highly skilled nation-state actor. Enfal is notable for its simplicity and reliability; rather than relying on massive exploits, it utilizes stealthy HTTP communication and basic encryption to remain undetected for months or years.<br><br><b>Execution and APT Mechanics</b><br>APT groups typically distribute Enfal via highly targeted spearphishing emails (`T1566.001`) containing weaponized Office documents (often exploiting CVE-2012-0158 or similar legacy vulnerabilities). Upon execution, the payload (`T1204.002`) drops the Enfal DLL into the `%SystemRoot%` directory and establishes persistence as a Windows Service (`T1543.003`). Enfal is designed for covert communication (`T1071.001`); it communicates with its Command and Control (C2) server using simple HTTP GET and POST requests, often mimicking legitimate web traffic. The C2 domain is usually hardcoded or generated dynamically. Once connected, the attacker can upload further specialized tools (like credential dumpers), download sensitive files (`T1041`), and execute arbitrary shell commands (`T1059.003`) to move laterally.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating, long-term compromise of intellectual property and state secrets. The primary network IoC is beaconing HTTP traffic (often lacking standard User-Agent strings or using hardcoded, anomalous headers) to unknown or recently registered domains. EDR logs will show the creation of a suspicious Windows Service designed to launch a newly dropped DLL file. Memory analysis is often required to extract the hardcoded C2 infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1041",
    "T1543.003",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (HTTP C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; an active Enfal infection means a highly skilled nation-state actor is operating within the network.",
    "Assume all local credentials and sensitive documents on the machine have been compromised. Enforce immediate password resets.",
    "Capture a full memory dump (RAM) and forensic disk image before powering off the machine. The memory dump is crucial to extract the decrypted C2 URLs.",
    "Perform a complete bare-metal wipe and reinstall of the operating system; APT actors utilize highly advanced, undocumented persistence mechanisms."
  ],
  "what_to_avoid": [
    "Do not assume the attack is over if one Enfal instance is quarantined; these actors frequently deploy multiple, redundant backdoors.",
    "Avoid tipping off the adversary; coordinate with specialized incident response teams before taking noisy containment actions."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}