{
  "family": "siplog",
  "sample_count": 2,
  "category": "trojan",
  "description": "Trojan:Win32/Siplog is a specialized Information Stealer designed specifically to target and compromise Voice over IP (VoIP) communications. Its primary objective is to silently monitor network traffic or hook into VoIP client software to capture SIP (Session Initiation Protocol) credentials, call logs, and potentially intercept the audio streams of active phone calls (`T1056`).<br><br><b>Understanding Siplog (VoIP Stealers)</b><br>To an end-user, the infection is completely invisible; their VoIP softphone (like X-Lite, Zoiper, or Skype) continues to function normally. For a security operations center (SOC), Siplog represents a severe breach of confidentiality. Stolen SIP credentials allow attackers to commit 'toll fraud' (routing expensive international calls through the corporate PBX), while intercepted audio can lead to devastating corporate espionage.<br><br><b>Execution and Interception Mechanics</b><br>Siplog is typically deployed as a secondary payload by a more generic dropper. Once active, it utilizes two primary methods. First, it may act as a local packet sniffer (`T1040`), monitoring the network interface for unencrypted SIP traffic (port 5060) to extract plain-text usernames and passwords used during authentication. Second, against encrypted or modern VoIP clients, it may utilize process injection and API hooking (`T1056.001`) to capture credentials directly from the softphone's memory before they are encrypted, or even hook the Windows audio APIs (like `waveInAddBuffer`) to record the actual voice conversation to a hidden `.wav` file for later exfiltration.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant financial loss due to toll fraud to the catastrophic compromise of sensitive corporate communications. Host-based IoCs include EDR alerts for anomalous processes loading `wpcap.dll` (WinPcap) to facilitate packet sniffing, or suspicious DLL injection into known VoIP client executables. A critical IoC is the sudden appearance of large, hidden audio files (e.g., `.wav` or `.mp3`) in temporary directories. Network IoCs include the malware attempting to exfiltrate these large files to unknown external FTP or HTTP servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1005",
    "T1056",
    "T1040"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1040",
      "name": "Network Sniffing (Capturing unencrypted SIP authentication traffic)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1056",
      "name": "Input Capture (Hooking audio APIs to record conversations)",
      "tactic": "Collection"
    },
    {
      "id": "T1005",
      "name": "Data from Local System (Stealing saved SIP configuration files)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised endpoint and revoke the SIP credentials associated with the user's softphone extension.",
    "Review PBX or SIP trunk billing logs immediately for anomalous international calling patterns indicative of toll fraud.",
    "Hunt for instances of unauthorized packet capture drivers (like WinPcap or Npcap) installed on standard user workstations.",
    "Enforce TLS encryption for all SIP signaling (SIPS) and SRTP for audio media to mitigate local network sniffing."
  ],
  "what_to_avoid": [
    "Do not assume the compromise is limited to the endpoint; if SIP credentials were stolen, the corporate PBX is now under attack.",
    "Avoid relying solely on basic AV to detect audio hooking; EDR behavioral analysis is required to catch API interception."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}