Loading malware…
Staatstrojaner is a German government surveillance trojan publicly exposed in 2011 and also referred to as R2-D2 and 0zapftis. It is a Windows malware implant designed for covert monitoring and remote control of infected systems. Reported functionality includes screenshot capture, Skype and VoIP interception, audio recording, host fingerprinting, proxy-aware command-and-control communications, download-and-execute of additional payloads, self-update, forced reboot, and enable/disable control operations. Analysis of the implant also identified process-aware initialization logic, command dispatching, AppInit-based persistence, and installation of a kernel driver used for monitoring-related functionality. The malware communicates using a custom protocol associated with the marker C3PO-r2d2-POE, and deeper reverse engineering recovered AES-based command-and-control encryption in some analyzed samples, although public reporting on the family also documented severe security weaknesses including command traffic lacking proper encryption, authentication, and integrity protection and ineffective protection of collected screenshots and audio. The malware became notable because its capabilities exceeded narrowly scoped source-telephony interception and included broader remote-execution and surveillance features. Reporting linked the spyware to German law-enforcement use and to DigiTask as a commercial supplier. Staatstrojaner is best characterized as a state-use spyware platform targeting Windows endpoints for covert interception and remote operational control.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A surveillance RAT/Trojan used as a malware case study. The sample supports screenshots, Skype/VoIP interception, persistence via AppInit_DLLs and a kernel driver service, covert C2 communications over a proxy-aware HTTP CONNECT channel, process-aware activation, command dispatching, download-and-execute of secondary payloads, host fingerprinting, and AES-encrypted C2 traffic.
Government surveillance trojan used for “source wiretapping” of Internet telephony; analysis described capabilities including remote control, screenshot capture, and fetching/executing arbitrary code, with noted security weaknesses (e.g., unencrypted command channel, weak encryption of collected data).
Government surveillance malware used to secretly monitor suspects' computers for internet telephony interception, with additional remote-control, screenshot capture, and arbitrary code execution capabilities noted by CCC.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.