Loading malware…
CyberAIDS is an early Apple II ProDOS virus family and, together with Festering Hate, is described as among the first Apple II ProDOS viruses. The content indicates that CyberAIDS was a series of closely related variants with minor code changes, culminating in the final 1988 version known as Festering Hate. It was highly destructive compared with earlier Apple II malware such as Elk Cloner. On infected Apple II systems, it spread to system files across hard drives, floppy disks, and system memory, and ultimately destroyed data once no uninfected files remained.
The malware appears to have originated in the pirate software underground, where the payload was attached to cracked software distributed through pirate channels and BBS ecosystems. It was discussed on Usenet as early as 1985 and 1986, and appears to have reached broader circulation in 1987 after spreading beyond the pirate underground. Festering Hate is specifically described as having bridged the malware into mainstream Apple II use through the shareware telecommunications application Zlink; some users initially believed Zlink itself was a Trojan horse delivering the payload.
The detonation page for Festering Hate credited the aliases "Rancid Grapefruit" and "Cereal Killer" of the "Kool/Rad Alliance," included the slogan "Elect LORD DIGITAL as God committee!," and reportedly embedded the home phone number of John Maxfield, also known as "Cable Pair." The final version also appears to have included a sarcastic taunt aimed at Glen Bredon, an Apple II programmer selling anti-virus software for ProDOS viruses. Contemporary anti-virus tooling for Apple ProDOS systems reportedly targeted CyberAIDS and Festering Hate as the only known ProDOS viruses at the time.
Morgan Davis is credited with fixing the final strain and releasing VirusMD for free in 1988, which helped end the feud between the malware authors and Apple II anti-virus developers; VirusMD later became a commercial product. A description of CyberAIDS behavior was published in the Summer 1988 issue of 2600 Magazine by "The Plague of MOD." The content further states that the article implied or revealed links between the aliases and Legion of Doom members Lord Digital and Dead Lord. The source code for CyberAIDS/Festering Hate is not known to be publicly available.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Festering Hate was the last iteration of the CyberAIDS code-base and seems to have bridged the virus from underground pirate BBS systems to the mainstream, by way of a shareware telecommunications application called Zlink. In fact, the original impression was that Zlink itself was nothing but a Trojan horse that delivered a viral payload.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacking in the 1980s ... Malware ... Christmas Tree EXEC ... CyberAIDS ... EGABTR
Malware ... CyberAIDS
Malware ... CyberAIDS
A series of Apple II ProDOS viruses that spread from the pirate underground into mainstream networks, originally attached to cracked software. Its final version was Festering Hate.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.