Threat intelligence / Malware

cd00r

[cd00r](https://attack.mitre.org/software/S1204) is an open-source backdoor for UNIX and UNIX-variant operating systems that was orginally released in 2000. [cd00r](https://attack.mitre.org/software/S1204) source code is primarily based on a packet-capturing program as it utilizes a sniffer to listen for specific sequences of network traffic or "secret knock" before executing the attacker's code.(Citation: Hartrell cd00r 2002)(Citation: Lumen J-Magic JAN 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[cd00r](https://attack.mitre.org/software/S1204) is an open-source backdoor for UNIX and UNIX-variant operating systems that was orginally released in 2000. [cd00r](https://attack.mitre.org/software/S1204) source code is primarily based on a packet-capturing program as it utilizes a sniffer to listen for specific sequences of network traffic or "secret knock" before executing the attacker's code.(Citation: Hartrell cd00r 2002)(Citation: Lumen J-Magic JAN 2025)

Labels

malware

4 recorded

Relationships

uses

to Network Sniffing

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Port Knocking

Technique

uses

to System Network Configuration Discovery

Technique

3 external

References

mitre-attack

S1204

Lumen J-Magic JAN 2025

https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/

Hartrell cd00r 2002

https://www.giac.org/paper/gcih/342/handle-cd00r-invisible-backdoor/103631