Netskope Threat Labs

Taidoor

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

Taidoor is a remote access trojan associated with Chinese state sponsored actors that has targeted Windows systems for reconnaissance and data theft since the late 2000s. Its campaigns focus on Taiwan government and industry targets, delivered through spear phishing documents that exploit common document flaws. The family's long history and steady updates illustrate the persistence of regionally focused espionage toolsets.

Stats

First seen
March 2022
Last seen
October 2026

MITRE ATT&CK techniques

20 techniques across 8 tactics.

TA0001 Initial Access

TA0002 Execution

TA0003 Persistence

  • T1547Boot or Logon Autostart Execution

TA0005 Stealth

TA0007 Discovery

  • T1012Query Registry
  • T1016System Network Configuration Discovery
  • T1057Process Discovery
  • T1083File and Directory Discovery
  • T1124System Time Discovery

TA0009 Collection

  • T1005Data from Local System

TA0011 Command and Control

TA0112 Defense Impairment

Alert name variants

Alert Name
DeepScan:Generic.Taidoor.1.FFFFFFFE
Dump:Generic.Taidoor.1.FFFFFFFE
Dump:Generic.Taidoor.1.FFFFFFFE:BB2B0
Generic.Taidoor.1.07B3CA1B
Generic.Taidoor.1.0AB09C6A
Generic.Taidoor.1.1021F472
Generic.Taidoor.1.1198B917
Generic.Taidoor.1.14185EB6
Generic.Taidoor.1.18207037
Generic.Taidoor.1.19B3ECEA

Related IPS Signatures

Signature Name
MALWARE-CNC Win.Trojan.Taidoor variant outbound connection

Related families

BisonalQakBotInvisiMoleMetamorfoPlugX

References