The first breach gets the attacker inside. A backdoor helps them return.
NIST defines a backdoor as an undocumented way of gaining access to a computer system.[ref] Criminals plant backdoors after compromise, hide them inside trusted software, and turn legitimate components into repeat-entry routes. Removing the infection that first drew attention does not remove the access they established elsewhere.
How attackers use backdoors:
🕸️ Web shells - After exploiting a public-facing server, attackers implant server-side scripts for persistent remote access and use the compromised server as a gateway into the network. MITRE documents this as a recurring persistence technique across multiple threat groups.[ref]
📦 Supply-chain backdoors - Attackers compromise one trusted product or update to reach many organizations at once. SUNBURST was inserted into SolarWinds Orion builds distributed in 2020. Up to 18,000 customers downloaded affected versions; SolarWinds later estimated that fewer than 100 were actually hacked through SUNBURST.[ref]
🧬 Malware implants - Backdoor implants wait for commands, collect information, and fetch additional malicious tools. They preserve remote control quietly instead of announcing themselves through immediate, noisy damage.
🪪 Rogue accounts and authentication changes - Attackers create administrator accounts, add unauthorized credentials, and alter identity or trust settings. Their return route resembles normal access because it uses the system's own login mechanisms.
🛠️ Abused remote-management tools - Attackers install or modify legitimate support software, scheduled tasks, startup scripts, and tunnels for repeat access. The tool is legitimate; the hidden persistence is not.
🫥 Backdoors behind the first incident - CISA found the SUPERNOVA web-shell backdoor during an incident involving a long-running enterprise compromise. It illustrates why closing the exploited vulnerability alone is not enough: defenders must also hunt for persistence already left behind.[ref]
That is the appeal. Defenders repair, monitor, and lock the breached front door while the criminal returns through an entrance the investigation missed.
What can we do:
For individuals:
- Install software and updates only from trusted sources, keep devices patched, and remove applications or browser extensions you no longer use.
- If a device behaves suspiciously after an infection, changing the password alone does not remove persistence. Update it, scan it, and ask trusted support to determine whether it needs to be reset or rebuilt.
- Disconnecting a suspected personal device from the network interrupts active remote access, but it does not remove a persistent backdoor. Keep it isolated until trusted support investigates and safely cleans, resets, or rebuilds it. In an organization, follow the incident-response team's evidence-preservation instructions before shutting it down.
For organizations:
- Patch internet-facing systems quickly, but pair patching with a search for web shells, rogue accounts, altered startup items, unauthorized remote tools, and unusual outbound connections.
- Use file-integrity monitoring, application allowlisting, EDR, centralized logs, and least privilege to make persistence harder to hide.
- Validate software updates and protect build pipelines, signing keys, and administrator access.
- During incident response, identify every persistence mechanism before declaring the environment clean. CISA recommends extended analysis when an incident indicates that attackers established additional or hidden persistence.[ref]
Removing the malware you noticed is good. Finding the quiet way back in is what finishes the job.