MITRE ATT&CKsoftware (malware)
S1204 cd00r
- Domain
- enterprise
- Platforms
- Network Devices
- Version
- 1.0
- Created
- 2025-02-19
Description
cd00r is an open-source backdoor for UNIX and UNIX-variant operating systems that was orginally released in 2000. cd00r source code is primarily based on a packet-capturing program as it utilizes a sniffer to listen for specific sequences of network traffic or "secret knock" before executing the attacker's code.
Related
References
- https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/ Lumen J-Magic JAN 2025
- https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631 Hartrell cd00r 2002