cd00r

cd00r is an open-source passive backdoor for Unix-like systems that waits for specially crafted network traffic rather than exposing a conventional listening service. Originally released around 2000 by the phenoelit group, it is designed for stealth: it uses packet-capture functionality, commonly via libpcap, to monitor inbound traffic for a predefined TCP port-knocking or magic-packet sequence and only then activates follow-on access. Because it does not normally present an open port, it can evade basic network inspection methods that rely on identifying listening services.

The malware’s core behavior is to monitor captured packets for specific sequences and, when triggered, enable attacker control of the compromised host. Variants and derivatives based on cd00r have been observed to establish shell access or otherwise support remote command execution after receipt of the trigger traffic. cd00r has also served as the basis for later Linux backdoors used in real intrusions, including custom variants deployed post-compromise and malware families such as SEASPY. A Linux Turla implant discovered in the wild was described as a stealth backdoor based on cd00r source code that used packet capture to detect magic packets and then connected back to the sender to execute commands.

cd00r is associated primarily with Linux and other Unix-like environments and is notable less as a modern malware family than as a foundational open-source backdoor design that has influenced later passive implants. Its operational value lies in stealthy post-compromise access and defense evasion through covert activation over network traffic rather than overt command-and-control beacons or exposed services.