{
  "family": "pclnt",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nPclnt is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to compromised Windows systems. Unlike highly automated botnets, Pclnt is often utilized in targeted attacks, allowing the threat actor to manually explore the infected network, steal sensitive data, and manipulate the system as if they were sitting directly at the keyboard.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPclnt is primarily distributed via targeted spear-phishing campaigns (often utilizing weaponized Office documents) or deployed as a secondary payload by initial access brokers who have already breached the perimeter via exposed RDP ports or VPN vulnerabilities.\n\nOnce the backdoor is executed on the victim's machine, it establishes a deep foothold:\n<ul>\n<li><strong>Covert C2 Communication:</strong> Pclnt establishes a persistent, encrypted connection to its command-and-control (C2) server. It typically operates over standard web ports (HTTPS/443) or utilizes customized protocols designed to blend in with legitimate enterprise traffic and bypass edge firewalls.</li>\n<li><strong>Interactive Shell and File Manipulation:</strong> The backdoor provides the attacker with an interactive remote shell (cmd.exe or PowerShell), allowing them to execute arbitrary commands with the privileges of the infected user. The attacker can silently browse the file system, upload exfiltration tools, or download proprietary data.</li>\n<li><strong>System Manipulation:</strong> Pclnt allows the attacker to view and terminate running processes, edit the Windows Registry, and manipulate Windows Services, enabling them to disable local antivirus solutions or install further persistence mechanisms.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Pclnt infection is a critical security incident. The malware's extensive capabilities mean that the compromised endpoint is fully under the control of the attacker. This leads directly to the loss of intellectual property, compromised user credentials, and the near certainty of lateral movement across the enterprise network.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Isolation:</strong> Sever the affected machine's network connection immediately. This halts the connection to the C2 server and prevents active data exfiltration or lateral movement.</li>\n<li><strong>Forensic Analysis:</strong> Perform a deep forensic review of the endpoint. Because the attacker had interactive access, responders must determine exactly what commands were executed via the backdoor to understand the full scope of the breach.</li>\n<li><strong>Comprehensive Credential Reset:</strong> Assume all credentials utilized on the infected machine, as well as any stored in browsers or password managers, are fully compromised. Initiate an immediate, organization-wide password reset.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Backdoor.Pclnt",
    "Trojan.Pclnt",
    "Win32/Pclnt"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059",
    "T1105",
    "T1056",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:11:36Z",
  "type": "Backdoor / Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}