Bifrost (Bifrose) RAT Technical Intelligence Dossier

Executive Summary & Threat Architecture

Bifrost (also documented across threat research as Bifrose, Backdoor:Win32/Bifrose, and Trojan.Bifrose) is a resilient, long-standing remote access trojan (RAT) that first surfaced in 2004 and maintained widespread operational use for over a decade in both financially motivated crimeware and state-sponsored cyber espionage campaigns. Authored in C++, Bifrost features a dual-mode communication architecture supporting both direct connection and reverse connection proxying, allowing operators to bypass corporate firewalls and NAT perimeters without requiring port forwarding on victim networks. The implant incorporates sophisticated kernel-level rootkit capabilities: it hooks the Windows System Service Dispatch Table (SSDT) and subverts Native API functions (including ZwQueryDirectoryFile and ZwQuerySystemInformation) to hide its files, registry entries, and network connections from Windows Task Manager and traditional antivirus scanners. Bifrost grants operators extensive remote workstation surveillance, including low-level keystroke logging via custom hook DLLs, webcam capture, screen surveillance, file transfer, remote shell execution, and registry editing. Threat actors frequently package Bifrost using multi-layered runtime crypters and deploy it via targeted spear-phishing emails containing exploit documents targeting vulnerabilities such as CVE-2012-0158 and CVE-2010-0805.

Observed Threat Aliases: Bifrose, Backdoor:Win32/Bifrose, Trojan.Bifrose, Win32/Bifrose, Bifrost RAT

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: Proprietary origin

Documented Downstream Variants: bifrost_v1.1, bifrost_v1.2, bifrose_rootkit

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Bifrost (Bifrose) RAT operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Spear-phishing emails containing malicious Microsoft Office attachments exploiting CVE-2012-0158
• Drive-by compromise downloads from hijacked websites exploiting CVE-2010-0805
• Bundled trojan installers shared on public peer-to-peer file networks

Host Persistence & Execution Hooks

• HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Bifrost
• Rootkit service installation hooking kernel dispatch routines
• Process injection into winlogon.exe or explorer.exe

Reference File Hashes (SHA-256)

• 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c
• ed01ebf8304d164ff5fe90222e3e5fc132e169a4ccdd6e5e30e3f90fb1b49c71