Skip to content
The Incident Ledger

Trojan

noun · also Trojan horse · NIST CSRC Glossary

Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.

Like the wooden horse of the Greek legend, a trojan gets inside by looking like something welcome. It does not spread on its own: the victim runs it, believing it is a useful program, a document or a software update. Once running, it does whatever its author built it for, often while the advertised function keeps working so nothing seems wrong.

Many families are named after what they do once installed: banking trojans steal financial credentials, remote access trojans (RATs) give the attacker full control of the machine, and droppers or loaders exist only to install the next piece of malware. Emotet, for example, began as a banking trojan and became one of the most widespread loaders for other criminal groups.

Example

A user searches for a free PDF editor and downloads it from an ad at the top of the results. The installer works and the editor opens, but it also installs a remote access trojan that connects to the attacker's server every few minutes, waiting for commands.

Why it matters for a SOC analyst

When an alert names a trojan, the most important questions are how it arrived (email, download, removable media), whether it ran, and whether it ever reached its command-and-control server. A trojan that connected out may already have downloaded other tools or stolen credentials, so the investigation does not end when the file is removed.

Related terms

  • Malware

    Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.

  • Command and control

    The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.

  • Fileless malware

    Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.

  • Botnet

    A network of compromised devices controlled remotely by an attacker and used together for spam, DDoS attacks, credential attacks or proxying traffic.