Loading story…
The Mydoom e-mail worm, also tracked as Novarg and W32/MyDoom, spread at record speed across the internet, infecting hundreds of thousands of computers and generating millions of malicious messages in more than 200 countries. Security firms said the worm relied on social engineering rather than advanced exploitation, arriving as spoofed e-mails that appeared to be bounced or undelivered messages and carrying executable attachments disguised as harmless text or ZIP files. The outbreak was severe enough that the U.S. Department of Homeland Security activated its cyber alert system, while Microsoft and SCO Group each offered $250,000 rewards for information leading to the author’s arrest.
The worm also converted infected systems into denial-of-service bots. Mydoom.A was programmed to attack SCO Group, while Mydoom.B shifted its focus to Microsoft and additionally altered the Windows Hosts file to block access to antivirus vendors’ websites, complicating cleanup for victims. By early February, mail-filtering data showed the outbreak was beginning to fade after peaking in late January, and monitoring indicated the Microsoft-targeting variant caused little measurable disruption because it spread less widely than the original strain.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
By 3 February, monitoring data showed Mydoom infections were falling after peaking on 28 January. Variant B's planned attack on Microsoft appeared to have little effect, with only minor response-time changes observed and no clear evidence of significant disruption.
The original Mydoom variant was programmed to flood SCO Group's website with traffic, disrupting access. Reporting described the attack as scheduled for February 1 and associated it with infected machines acting as bots.
Researchers and mail-filtering firms concluded that Mydoom had become the fastest-spreading email virus observed at the time. It ultimately infected systems in 214 countries and generated more than 21 million intercepted copies.
Microsoft published security guidance describing the Mydoom.A and Mydoom.B worm variants. The guidance noted that variant B redirected the denial-of-service objective toward Microsoft and altered infected systems to block access to antivirus websites.
The U.S. Department of Homeland Security activated its new cyber alert system in response to the Mydoom outbreak. The move reflected concern over the worm's rapid spread and its built-in denial-of-service capabilities.
SCO Group and Microsoft each offered $250,000 rewards for information leading to the arrest of the worm's author. The offers came as Mydoom's denial-of-service components targeted SCO and threatened Microsoft.
The Mydoom email worm, also known as Novarg, began propagating rapidly through spoofed messages carrying executable attachments disguised as harmless files. Security firms reported massive volumes of malicious email and widespread infections across hundreds of thousands of computers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
abcnews.go.com
Open sourceweb.archive.org
Open sourcenews.bbc.co.uk
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **Conficker** variant, also known as **Kido** or **Downadup**, reactivated infected hosts through peer-to-peer communications and resumed worm behavior by spreading between systems and downloading additional malware. Kaspersky reported that compromised machines pulled down a rogue antivirus detected as `FraudTool.Win32.SpywareProtect2009.s` and the **Waledac** email worm, detected as `Email-Worm.Win32.Iksmas.atz`, which added spam-sending and data-theft capabilities to already infected endpoints. Technical analysis and sample listings show the malware propagated through multiple channels, including exploitation of **`MS08-067`**, SMB brute forcing, and removable media using `autorun.inf` and disguised DLL files. The worm established persistence, injected into processes such as `Explorer.exe` and `Svchost.exe`, blocked DNS access to security resources, altered TCP settings, disabled protections and services, deleted restore points, and used a domain generation algorithm to maintain resilience on legacy Windows systems, particularly older **Windows XP** environments.
Aug 15, 2026
A newly disclosed **Microsoft Windows Plug and Play buffer overflow** vulnerability, tracked as `VU#998653` and addressed by Microsoft's `MS05-039` patch, was rapidly weaponized into multiple worms including **Zotob**, **RBot**, **SD-Bot**, and related IRC bot variants. The malware primarily targeted unpatched **Windows 2000** systems, disrupting high-profile organizations such as **CNN**, **The New York Times**, **ABC News**, and parts of **Capitol Hill**. Security researchers said the outbreak drew intense attention because of the prominent victims, but Internet monitoring groups and Microsoft assessed it as more localized than an Internet-wide epidemic, with **Windows XP** largely unaffected and patched or firewalled systems better protected. The incident showed how quickly exploit code could follow a patch release, with public exploits appearing within days and Zotob detected shortly afterward as attackers folded the flaw into existing bot malware. Antivirus vendors and responders urged organizations to apply patches, update signatures, isolate infected hosts, and use removal tools for the growing list of Zotob variants. Investigators later detained **Farid Essebar** in Morocco and **Atilla Ekici** in Turkey in connection with the worm campaign, while researchers said the arrests also exposed a broader underground trade in compromised PCs and shared malware source code that enabled continued variant development.
Jun 29, 2026
WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in **MS17-010**, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's **NHS**, **Telefónica**, **Iberdrola**, Russia's Interior Ministry, **FedEx**, and **Deutsche Bahn**, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of **$300** or **$600** in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as **Windows XP** as governments and incident responders urged organizations to report infections and patch exposed systems. Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the **DoublePulsar** backdoor, and used **EternalBlue** when DoublePulsar was absent to deliver the ransomware payload. WannaCry used **RSA-2048** and **AES-128** for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated **Windows 7** and **Windows Server 2008** accounted for most infections, while many **XP** systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.
Aug 14, 2026