ILOVEYOU
ILOVEYOU, also known as VBS/Loveletter and the Love Bug worm, was a mass-mailing worm active in 2000 that infected millions of Windows computers worldwide within hours of release; one source in the content states it infected more than 10 million systems. It spread by email as a purported love-letter file and, when opened, sent itself to the victim’s contacts, making it wormable and one of the defining early-2000s email worms. The content consistently places it among the major “great worms” that drove widespread cybersecurity disruption between 1998 and 2005, alongside Melissa, Nimda, Slammer, Sobig, Code Red, Mydoom, and Conficker. It is referenced as a historical example of insecure email-driven malware propagation and user-execution-based infection. The content also notes reporting that the worm originated in the Philippines and that it was created by a Filipino student for a thesis. High-confidence aliases directly mentioned are VBS/Loveletter and Love Bug worm.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Command and Control
1 technique
Command and Control
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A major worm cited as part of the early 2000s 'great worms' that caused significant disruption.
A historically significant email-borne worm/virus cited as an example of early internet-era malware that taught costly security lessons.
A wormable email-borne virus that arrived as a purported love letter text file; when opened, it overwrote and corrupted files and sent itself to all contacts, infecting over 10 million Windows computers.
The ILOVEYOU virus walked so that MyDoom could run.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.