A backdoor is any method of bypassing normal authentication or security checks to get into a system — a hidden entrance an attacker (or careless developer) leaves open so they can return without repeating the original break-in. It is not one technique but a family of them: a hidden admin account, a silent remote-access tool, an undocumented API endpoint, a hardcoded password in firmware. This guide covers the types, how backdoors get into a small business environment, and the controls that close them in 2026.
TL;DR
- A backdoor bypasses normal authentication — a hidden entrance that outlives the original attack and reopens it at will.
- Common forms: hidden admin accounts, remote-access trojans, undocumented API endpoints, hardcoded credentials in software or firmware.
- They enter through trojanised downloads, phishing payloads, compromised vendor software, or careless development and configuration.
- A backdoor's value is persistence: even after you reset passwords, the hidden entrance keeps working.
- The controls that close them: least privilege, MFA everywhere, fast patching, software allow-lists — and training that stops the trojanised install.
Why backdoors matter more than the break-in
The break-in is an event. A backdoor is a standing invitation. An attacker who gets in once and gets patched out has lost; an attacker who gets in once and installs a hidden entrance keeps access through password resets, patch cycles and even OS reinstalls (if the backdoor sits in firmware or the boot chain).
This is why incident response treats 'how did they get in AND how did they stay in' as two questions. The answer to the second is almost always a backdoor of some kind. A real example at national scale: the US Cyber Safety Review Board's 2024 assessment of the 2023 Barracuda ESG zero-day attacks found a distinct second backdoor (SALTWATER) separate from the exploited vulnerability — attackers routinely plant a second door before the first is closed.
The types of backdoor
- Hidden or extra admin accounts. An account nobody knows about, created during a compromise or left over from a vendor install. It appears in user lists as ordinary; its password is the attacker's.
- Remote-access trojans (RATs). Malware that opens a persistent channel to the attacker's server, letting them control the machine at will. A RAT is the most common backdoor a small business will actually encounter, and it arrives exactly like other trojans.
- Web shell on a server. A small script uploaded to a compromised web server that accepts commands through ordinary-looking HTTP requests. Firewalls see normal web traffic; the attacker sees a command console.
- Undocumented API endpoints and exposed admin panels on line-of-business software — an interface nobody knows exists, often with weak or default credentials.
- Hardcoded credentials. Default passwords, universal keys or test accounts left in firmware, devices or custom software. These are backdoors nobody planted recently — they shipped with the product.
- Physical and network backdoors. An unsecured remote-access tool left enabled, a forgotten VPN account, a 4G maintenance modem on a building controller.
How a backdoor gets into your environment
- Trojanised downloads. The fake installer that carries a RAT — the same delivery route as keyloggers and rootkits. The user installs it themselves, often with admin rights.
- Phishing payloads. Attachments and macro-laced documents that drop a remote-access tool or create a local account.
- Compromised software updates or vendor software. Supply-chain incidents where a legitimate product ships with the backdoor built in.
- Careless development and configuration. Test accounts never removed, default passwords never changed, admin panels exposed to the internet. Most small-business backdoors are this kind — accidental, not planted.
- Malicious or negligent insiders. A departing employee quietly adding a forwarding rule, an admin creating a personal account 'for testing'.
How to detect a backdoor
No single signal proves one; patterns do:
- Unknown or disabled-then-reactivated accounts in admin lists — audit user lists quarterly.
- Outbound connections to unfamiliar servers, especially persistent ones that survive reboots.
- Services listening on unexpected ports, or remote-access tools nobody installed on purpose.
- Web server logs showing POST requests to paths that should not exist.
- Logins from impossible locations or at impossible hours on privileged accounts.
- Firmware or software versions that do not match what was deployed.
How to stop backdoors
- Least privilege and account audits. Nobody has access their role does not need; user lists get reviewed quarterly, and accounts nobody can explain get disabled immediately.
- MFA on every privileged and remote-access account. A hidden admin account with a stolen password hits a wall; a RAT cannot log in without a second factor. This is the highest-value control for the backdoor classes that authenticate.
- Patch fast, especially internet-facing systems. The exploited vulnerability is only half the incident; the backdoor survives the patch unless you hunt for it. After any intrusion, assume a second door exists and look for it.
- Allow-list software on machines that handle sensitive data, and restrict local admin rights — a RAT needs an install to persist.
- Change every default credential on devices, software and panels the day they are deployed.
- Egress filtering and monitoring. Alert on persistent outbound connections to unfamiliar destinations — the RAT's channel is visible from the network side even when invisible on the endpoint.
- Train the install decision. The trojanised installer needs a person to approve it. Cyber Aware's security awareness training rehearses fake-download and attachment lures monthly, and anyone who clicks a simulated lure gets remediation training the same day, closing the delivery route the backdoor depends on. Human risk reporting shows month by month whether click and report behaviour is improving.
For the technical controls — account audits, MFA coverage, patch cadence, egress monitoring — a cyber security gap assessment shows which you can evidence and which to close next.
FAQ
What is a backdoor in cyber security? Any hidden method of bypassing normal authentication or security checks — a hidden account, a remote-access tool, an undocumented endpoint, or credentials hardcoded into software or firmware.
Who creates backdoors? Three groups: attackers (to persist after a break-in), careless developers and vendors (test accounts, default passwords, undocumented endpoints), and insiders (personal remote-access tools, personal accounts).
How do backdoors get installed on business machines? Mostly through trojanised downloads and phishing payloads that users install themselves, or through unpatched internet-facing software an attacker exploits and then uses to create the hidden entrance.
Can a backdoor survive a password reset? Yes — that is its defining property. Password resets close the entry point that was exploited; a hidden account, RAT or firmware backdoor keeps working regardless. Full remediation means hunting for the second door, not just the first.
How do you check for backdoors on a network? Audit admin and user accounts against a known-good list, review listening ports and remote-access tools, check outbound connections to unfamiliar servers, and scan web servers for unexpected scripts. Patterns across several of these signals are more reliable than any single one.
Does MFA stop backdoors? It stops the ones that authenticate: hidden accounts and stolen-credential logins. It does not remove the backdoor itself — a RAT or web shell operates without logging in, so detection and removal still matter.
One last thing
Do one audit this week: list every account with admin or remote-access rights across your systems, and challenge each one — who created it, when, and is it still needed? The accounts nobody can explain are the standing invitations attackers value most, and they cost nothing to close.
Related guides
- What is a rootkit? The malware that hides from everything — the concealment layer that makes backdoors invisible.
- What is a trojan? The malware that hides in plain sight — the disguise that delivers them.
- What is data exfiltration? — what leaves through the hidden entrance while nobody watches.