Loading malware…
Love Bug is a mass-mailing email worm/virus referenced as one of the most notorious malware outbreaks. It propagated through email, including messages with the subject line "I Love You," and lured recipients to open an attached "love letter." The malware spread by harvesting or using contacts from the infected user’s address book and sending itself to those contacts, causing virus-generated emails to appear to come from trusted senders. The content associates Love Bug with Visual Basic scripting and the use of double extensions as relevant defensive lessons, indicating those techniques were used in similar outbreaks discussed alongside it. It is described as having caused billions of dollars in damage. The malware is mentioned in the context of broad email-borne threats and Trojan horse-style malicious attachments, and is also referenced as malware that script kiddies or toolkit users have propagated. High-confidence indicators directly mentioned in the content include the email subject line "I Love You" and the attached "love letter."
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
The virus infected about 45 million machines in 24 hours, leaving email systems overwhelmed.
The more important lesson to learn from virus outbreaks such as the Anna Kornikova virus and the Love Bug is that firms should consider blocking visual basic scripting and files with double extensions, both tricks used in the Anna bug, Cluley advises.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mass-mailing email worm/virus (commonly known as ILOVEYOU); referenced as an example of malware spread using readily available toolkits.
A named worm referenced as a comparable virus outbreak. In this content it is cited as an example underscoring the risk of Visual Basic scripting and deceptive double-extension files.
A notorious email worm/virus referenced for comparison; it spread by sending itself to everyone in a victim's address book and caused widespread damage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.