Malware

Rbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

The worms attack computers quietly, in the background, similar to how the infamous Nimda and Code Red worms operated.

T1190Exploit Public-Facing ApplicationEvidence1

About 10 Internet worms are currently making their way around the Internet, targeting the new Microsoft vulnerability... There's no need to open an e-mail attachment.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

15th - The existing IRCbot is updated to use the MS05-039 exploit as an attack vector demonstrating a blended threat.

T1203Exploitation for Client ExecutionEvidence1

14th - A worm utilising MS05-039 (PnP exploit) as an attack vector is released, it is first discovered by F-Secure and named Zotob.

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

About 10 Internet worms are currently making their way around the Internet, targeting the new Microsoft vulnerability... With so many variants making their way around the Internet, vulnerable computers are sure to be infected.

Lateral Movement

2 techniques

T1091Replication Through Removable MediaEvidence1

The worms attack computers quietly, in the background, similar to how the infamous Nimda and Code Red worms operated.

T1210Exploitation of Remote ServicesEvidence1

CNN, ABCNews, NYTimes and Capitol Hill report worm outbreaks in their networks, it appears to be either Zotob or the new RBot which uses 5 attack vectors ... including PnP.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

15th - The existing IRCbot is updated to use the MS05-039 exploit as an attack vector demonstrating a blended threat.

T1105Ingress Tool TransferEvidence1

When a new vulnerability is announced, existing worms can be upgraded to use it as a new attack vector. This is exactly what we have seen in this case and should expect more of in the future.

Impact

1 technique

T1529System Shutdown/RebootEvidence1

They showed computers continuously rebooting by themselves, an apparent effect of the worm.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

web archiveNews

Aug 18, 2005

MS05-039 and the Zotob summary - .tHE pRODUCT

An IRC bot/worm family updated to use multiple attack vectors, including the MS05-039 Plug and Play exploit, demonstrating a blended threat.

web archiveNews

Aug 17, 2005

Computer worms strike media outlets - Technology & science - Security | NBC News

Worm/bot malware observed exploiting the newly announced Microsoft Windows flaw, spreading without user interaction and disrupting vulnerable older Windows systems.

wikipedia cyber incidentsNews

Aug 16, 2005

Zotob - Wikipedia

A worm family from which Zotob was derived; described as capable of forcing infected computers to continuously restart and having multiple variants released to exploit the Windows 2000 Plug-and-Play flaw disclosed in MS05-039.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Rbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1091Replication Through Removable MediaEvidence1

The worms attack computers quietly, in the background, similar to how the infamous Nimda and Code Red worms operated.

T1190Exploit Public-Facing ApplicationEvidence1

About 10 Internet worms are currently making their way around the Internet, targeting the new Microsoft vulnerability... There's no need to open an e-mail attachment.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

15th - The existing IRCbot is updated to use the MS05-039 exploit as an attack vector demonstrating a blended threat.

T1203Exploitation for Client ExecutionEvidence1

14th - A worm utilising MS05-039 (PnP exploit) as an attack vector is released, it is first discovered by F-Secure and named Zotob.

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

Lateral Movement

2 techniques

T1091Replication Through Removable MediaEvidence1

The worms attack computers quietly, in the background, similar to how the infamous Nimda and Code Red worms operated.

T1210Exploitation of Remote ServicesEvidence1

CNN, ABCNews, NYTimes and Capitol Hill report worm outbreaks in their networks, it appears to be either Zotob or the new RBot which uses 5 attack vectors ... including PnP.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

15th - The existing IRCbot is updated to use the MS05-039 exploit as an attack vector demonstrating a blended threat.

T1105Ingress Tool TransferEvidence1

When a new vulnerability is announced, existing worms can be upgraded to use it as a new attack vector. This is exactly what we have seen in this case and should expect more of in the future.

Impact

1 technique

T1529System Shutdown/RebootEvidence1

They showed computers continuously rebooting by themselves, an apparent effect of the worm.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

web archiveNews

Aug 18, 2005

MS05-039 and the Zotob summary - .tHE pRODUCT

An IRC bot/worm family updated to use multiple attack vectors, including the MS05-039 Plug and Play exploit, demonstrating a blended threat.

web archiveNews

Aug 17, 2005

Computer worms strike media outlets - Technology & science - Security | NBC News

Worm/bot malware observed exploiting the newly announced Microsoft Windows flaw, spreading without user interaction and disrupting vulnerable older Windows systems.

wikipedia cyber incidentsNews

Aug 16, 2005

Zotob - Wikipedia

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.