Sobig

Sobig is a mass-mailing Windows worm that emerged in multiple variants from early 2003, with Sobig.F becoming one of the most widespread and fastest-spreading e-mail worms of its era. It infected millions of Microsoft Windows systems and caused major global disruption, including substantial e-mail congestion and secondary operational impacts on organizations and infrastructure-dependent networks.

Sobig propagated primarily through malicious e-mail attachments presented as benign or routine messages. When a recipient executed the attachment, the worm installed and used its own SMTP engine to send copies of itself to addresses harvested from local files on the compromised host. This made it highly effective at self-distribution without relying on the victim’s normal mail client. Sobig also used social-engineering lures in message subjects and body text to increase the likelihood of execution.

The malware exhibited both worm and Trojan characteristics: it self-replicated aggressively while also masquerading as legitimate content to induce user execution. Earlier Sobig variants reportedly installed proxy functionality using legitimate software in a backdoor-like configuration that could facilitate spam operations. Sobig.F also contained update or secondary-payload retrieval logic, being programmed to contact a set of remote systems over UDP to download or install an additional program, although the intended follow-on payload remains unclear.

Sobig was built for Microsoft Windows and is commonly associated with the major worm outbreaks that defined early-2000s Internet malware. Its most notable variant, Sobig.F, deactivated itself on a preset date. Microsoft later offered a reward for information leading to the author’s arrest. Public attribution to a specific author has been reported but remains unconfirmed, so no creator attribution can be stated with high confidence.