S0258 RGDoor

malwareEnterprise

platformsWindows

also known asRGDoor

RGDoor is a malicious Internet Information Services (IIS) backdoor developed in the C++ language. RGDoor has been seen deployed on webservers belonging to the Middle East government organizations. RGDoor provides backdoor access to compromised IIS servers.

techniques used (7)

ATT&CK techniques this enables or maps to.

T1033System Owner/User Discovery
T1059.003Windows Command Shell
T1071.001Web Protocols
T1105Ingress Tool Transfer
T1140Deobfuscate/Decode Files or Information
T1505.004IIS Components
T1560.003Archive via Custom Method

used by groups (1)

Threat groups associated with this.

G0049OilRig

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan