{
  "family": "netwire",
  "sample_count": 55,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nNetWire is a sophisticated, commercially available Remote Access Trojan (RAT) that has been active since at least 2012. Marketed ostensibly as a legitimate remote administration tool, its robust keylogging, credential theft, and cross-platform capabilities (targeting Windows, Linux, and macOS) have made it highly popular among cybercriminals and Advanced Persistent Threat (APT) groups. It is utilized post-compromise to establish stealthy persistence, exfiltrate sensitive data, and pivot within corporate networks.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nNetWire is overwhelmingly distributed via targeted spear-phishing campaigns. Attackers utilize malicious Microsoft Office documents containing weaponized macros or exploit known vulnerabilities (like CVE-2017-11882 in Equation Editor) to silently download and execute the RAT payload.\n\nOnce active, NetWire provides extensive, interactive control over the victim machine:\n<ul>\n<li><strong>Advanced Keylogging & Credential Theft:</strong> NetWire is renowned for its highly effective, custom-built keylogger. It also systematically searches the file system for browser profiles, email client databases (Outlook), and FTP configurations, decrypting and stealing all saved passwords.</li>\n<li><strong>Cross-Platform Capabilities:</strong> Uniquely among many commercial RATs, NetWire source code has been compiled to target macOS and Linux environments, allowing attackers to maintain a homogeneous C2 infrastructure while targeting diverse endpoints.</li>\n<li><strong>Remote Control and Evasion:</strong> The attacker has full GUI-based control over the file system, can execute arbitrary commands, and view the victim's screen. The RAT uses custom encryption for its C2 communications and often employs process hollowing to evade local AV detection.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA NetWire detection is a critical incident indicating a total compromise of the affected endpoint. The attacker has interactive, human-driven access to the machine, is actively capturing credentials, and possesses the capability to move laterally to compromise the broader domain.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Severance:</strong> The endpoint must be physically disconnected from the network instantly to terminate the attacker's interactive session and halt any ongoing data exfiltration.</li>\n<li><strong>Hunt for Lateral Movement:</strong> Because NetWire is heavily utilized for credential theft and espionage, incident responders must assume the attacker has attempted to move laterally. Scrutinize Active Directory logs for compromised credentials.</li>\n<li><strong>Total Re-imaging and Global Credential Reset:</strong> The machine is completely untrusted and must be wiped to bare metal. All credentials (user, service accounts, local admins) that were exposed to the compromised machine must be immediately reset.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "RAT.NetWire",
    "Backdoor.NetWire",
    "Win32/NetWire"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is NETWIRE?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A publicly available, multiplatform remote administration tool used by criminal and APT groups since at least 2012, frequently abused as a RAT."
      }
    },
    {
      "@type": "Question",
      "name": "Is NETWIRE cross-platform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes; it has variants able to run on multiple operating systems."
      }
    },
    {
      "@type": "Question",
      "name": "What can NETWIRE do?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remote control, keylogging, and theft of credentials and payment information."
      }
    },
    {
      "@type": "Question",
      "name": "Who uses NETWIRE?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE notes it has been used by both ordinary criminal actors and advanced persistent threat (APT) groups."
      }
    },
    {
      "@type": "Question",
      "name": "How is NETWIRE delivered?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mainly through phishing emails with malicious attachments."
      }
    },
    {
      "@type": "Question",
      "name": "How do I reduce the risk of RATs like NETWIRE?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Be cautious with attachments and downloads, keep endpoint protection updated, and verify any remote-access software on your machine was installed intentionally."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's NETWIRE entry (S0198), linked on this page."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1071.001",
    "T1056.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:49:34Z",
  "sources": [
    {
      "name": "MITRE ATT&CK: NETWIRE (S0198)",
      "url": "https://attack.mitre.org/software/S0198"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0198",
  "type": "Remote Access Trojan (RAT)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}