1. Home
  2. Software
  3. Taidoor

Taidoor

Taidoor is a remote access trojan (RAT) that has been used by Chinese government cyber actors to maintain access on victim networks.[1] Taidoor has primarily been used against Taiwanese government organizations since at least 2010.[2]

ID: S0011
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 2.0
Created: 31 May 2017
Last Modified: 15 October 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Taidoor has used HTTP GET and POST requests for C2.[2]
Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.[2]
Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

Taidoor can copy cmd.exe into the system temp folder.[1]
Enterprise T1005 Data from Local System

Taidoor can upload data and files from a victim's machine.[2]
Enterprise T1140 Deobfuscate/Decode Files or Information

Taidoor can use a stream cipher to decrypt stings used by the malware.[1]
Enterprise T1573 .001 Encrypted Channel: Symmetric Cryptography

Taidoor uses RC4 to encrypt the message body of HTTP content.[2][1]
Enterprise T1083 File and Directory Discovery

Taidoor can search for specific files.[1]
Enterprise T1070 .004 Indicator Removal on Host: File Deletion

Taidoor can use DeleteFileA to remove files from infected hosts.[1]
Enterprise T1105 Ingress Tool Transfer

Taidoor has downloaded additional files onto a compromised host.[2]
Enterprise T1112 Modify Registry

Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.[1]
Enterprise T1106 Native API

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.[2][1]
Enterprise T1095 Non-Application Layer Protocol

Taidoor can use TCP for C2 communications.[1]
Enterprise T1027 Obfuscated Files or Information

Taidoor can use encrypted string blocks for obfuscation.[1]
Enterprise T1566 .001 Phishing: Spearphishing Attachment

Taidoor has been delivered through spearphishing emails.[2]
Enterprise T1057 Process Discovery

Taidoor can use GetCurrentProcessId for process discovery.[1]
Enterprise T1055 .001 Process Injection: Dynamic-link Library Injection

Taidoor can perform DLL loading.[2][1]
Enterprise T1012 Query Registry

Taidoor can query the Registry on compromised hosts using RegQueryValueExA.[1]
Enterprise T1016 System Network Configuration Discovery

Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.[2][1]
Enterprise T1124 System Time Discovery

Taidoor can use GetLocalTime and GetSystemTime to collect system time.[1]
Enterprise T1204 .002 User Execution: Malicious File

Taidoor has relied upon a victim to click on a malicious email attachment.[2]

References

  1. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  1. Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.