FELIXROOT is a backdoor used to maintain covert remote access on compromised systems. Attackers use it to execute commands, collect information, and support follow-on activity while trying to avoid detection. Defenders should look for persistence, unexpected network connections, and signs of privilege abuse or tampered security controls on endpoints.
What FELIXROOT does for an attacker
FELIXROOT is valuable because it gives the operator a persistent foothold, not just a one-time intrusion. Once deployed, a backdoor like this lets an attacker issue commands, stage data, and coordinate follow-on activity from a compromised endpoint while blending into ordinary system noise.
That matters operationally because backdoors are usually about control and continuity. If the initial access vector is lost, the attacker still has a reusable channel for remote administration, reconnaissance, and movement to additional systems.
For a broader view of how backdoors fit into malware tradecraft, see Malware Guide.
How attackers typically use the access they gain
After establishing the backdoor, attackers usually use it to run commands interactively or on a schedule, enumerate the host, and collect information that helps them decide what to do next. That can include checking security tooling, discovering accounts or cached access material, and identifying nearby systems worth targeting.
The backdoor also supports operational flexibility. Operators can return later, adapt their activity to what the environment exposes, and keep their access even when a victim resets one path into the network.
For examples of how adversaries chain access, credential theft, and follow-on movement in real incidents, refer to The State of NHI & AI Agent Breach Report 2026.
What defenders should expect to see
The most useful detection mindset is to look for behavior that does not fit the endpoint’s normal role. Unexpected outbound connections, unusual parent-child process relationships, command execution from benign-looking binaries, and tampering with endpoint protections are all common clues when a backdoor is in play.
Privilege abuse is especially important to watch for. If the attacker can elevate, reuse cached credentials, or disable logging and security tools, the backdoor stops being only a remote shell and becomes a platform for deeper compromise.
Network and host telemetry are both important here, because a backdoor may look ordinary on disk while its traffic patterns, persistence hooks, or tool use reveal the compromise.
Risk and Threat Considerations
A backdoor is attractive because it turns one compromised endpoint into a reusable access path. That creates persistence risk, increases the chance of lateral movement, and can make a contained incident look dormant until the attacker decides to act again.
Failure mechanism: The attacker abuses the backdoor to maintain covert command execution, bypass normal access workflows, and conceal follow-on activity behind routine-looking host behavior or network traffic.
Impact: The result can be repeated compromise of the same system, expansion into adjacent assets, theft of data, or disruption of defensive controls that were supposed to detect the first intrusion.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | FELIXROOT is used to execute attacker commands on a host. |
| T1105 — Ingress Tool Transfer | Backdoors commonly deliver or stage payloads and follow-on tools. | |
| T1053 — Scheduled Task/Job | Backdoor persistence often relies on scheduled execution for repeat access. | |
| Recommendation — Map observed command execution to T1059 and inspect spawned processes for interactive abuse. Correlate suspicious downloads or staging activity with T1105 and isolate the host. Review scheduled tasks and jobs for unauthorized persistence and remove them. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detecting backdoor activity depends on retaining and reviewing host and network logs. |
| Recommendation — Centralize and review logs to detect persistence, privilege abuse, and suspicious connections. | ||
Practitioner Guidance
What to verify: Treat any unexplained persistence artifact, remote command channel, or disabled security control as a compromise indicator first, not a tuning issue. Confirm whether the host can still communicate with suspicious external destinations, whether scheduled or startup-based persistence exists, and whether administrative actions were executed outside normal change windows.
Decision rule: If the backdoor had any path to privileged execution or sensitive internal reach, prioritize containment and credential review before attempting to “clean” the host in place. If the system is business-critical, preserve memory, logs, and network evidence before remediation.
What good looks like: A cleaned endpoint should have its persistence removed, its security controls restored, and its access paths invalidated if there is any chance the attacker reused credentials or sessions. The endpoint should then be monitored for the same command pattern or external beaconing before it is trusted again.
Practitioner takeaway: With backdoors, the main question is not whether the malware is still present, but whether the attacker still has a reliable way back in.