Netskope Threat Labs

SysJoker

ATP Sandbox Adv. HeuristicsAV

SysJoker is a backdoor written from scratch in C++ that was first discovered in December 2021. It is cross platform, with Linux, Windows, and macOS variants, and its possible attack vectors include email attachments, malicious advertisements, and trojanized software.

First seen
April 2022
Last seen
October 2026
Alert Name
Gen:Variant.SysJoker.1
Gen:Variant.SysJoker.2
Gen:Variant.SysJoker.3
Gen:Variant.SysJoker.5
Gen:Variant.SysJoker.6
Gen:Variant.SysJoker.7
Linux.Trojan.SysJoker
MacOS.Trojan.SysJoker
Trojan.Linux.SysJoker.A
Trojan.Linux.SysJoker.B