NETWIRE

Description

NETWIRE is a remote access trojan sold commercially on underground forums for over a decade, and its buyers used it for surveillance and fraud across Windows, macOS, and Linux. It provides remote desktop control, password theft, and file management, and its long operational history produced many variants and loader relationships. Its developers shut the service down in 2020, but copies continue to circulate in criminal toolkits.

Stats

First seen: January 2022
Last seen: October 2026

MITRE ATT&CK techniques

45 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.002Spearphishing Link
- T1566.001Spearphishing Attachment

TA0002 Execution

T1053Scheduled Task/Job
- T1053.003Cron
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.001PowerShell
- T1059.004Unix Shell
- T1059.003Windows Command Shell
T1106Native API
T1204User Execution
- T1204.002Malicious File
- T1204.001Malicious Link

TA0003 Persistence

T1543Create or Modify System Process
- T1543.001Launch Agent
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder
- T1547.013XDG Autostart Entries
- T1547.015Login Items

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.011Fileless Storage
T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.011Fileless Storage
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
- T1036.001Invalid Code Signature
T1055Process Injection
- T1055.012Process Hollowing
T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1010Application Window Discovery
T1016System Network Configuration Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging
T1074Data Staged
- T1074.001Local Data Staging
T1113Screen Capture
T1119Automated Collection
T1560Archive Collected Data
- T1560.003Archive via Custom Method
T1560Archive Collected Data
- T1560.003Archive via Custom Method

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
T1095Non-Application Layer Protocol
T1102Web Service
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Backdoor.NetWire	ATP Sandbox Adv. Heuristics
Gen:Variant.NetWire.2	AV
GT:VB.Macros.NetWire.1.81F2D9CA	AV
GT:VB.Macros.NetWire.2.56E43306	AV
GT:VB.Macros.NetWire.2.56E43306:03D2F	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:081EF	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:2B177	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:365A2	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:48CC3	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:5D4DD	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:5DA01	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:677F3	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:71F24	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:816BF	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:8BFAF	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:93392	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:97C89	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:98A55	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:B743C	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:B781B	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:BBC28	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:FC622	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.56E43306:FCE49	ATP Sandbox Adv. Heuristics
GT:VB.Macros.NetWire.2.6176ED96	AV
GT:VB.Macros.NetWire.3.227604C5	AV
GT:VB.Macros.NetWire.3.227604C5:AEBCE	ATP Sandbox Adv. Heuristics
GT:VB.NetWire.2.51519BFC	AV
GT:VB.NetWire.3.93A1E4F1	AV
GT:VB.NetWire.3.E56856EC	AV
Linux.Backdoor.NetWire	ATP Sandbox Adv. Heuristics
VBA.Heur.NetWire.2.15B48C55.Gen	AV
VBA.Heur.NetWire.2.56E43306.Gen	AV
VBA.Heur.NetWire.2.81F2D9CA.Gen	AV
VBA.Heur.NetWire.3.7783F90E.Gen	AV
Win32.Backdoor.NetWire	ATP Sandbox Adv. Heuristics
Win64.Backdoor.NetWire	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Osx.Trojan.Netwire variant payload download attempt	IPS-SWG
MALWARE-CNC Win.Trojan.Netwire variant payload download attempt	IPS-SWG
MALWARE-OTHER Win.Dropper.NetWire-9781821-0 download attempt	IPS-SWG

Related families

QakBot InvisiMole PlugX KONNI TrickBot