Loading story…
Symantec identified W32.Koobface.A as a worm that propagates through social networking platforms by sending messages that lure users into visiting malicious websites and downloading a fake video codec or related malware component. The threat abuses trust between contacts, using compromised accounts to continue spreading and expanding its reach across user networks.
Once executed, Koobface installs itself on infected Windows systems and can modify system behavior to maintain persistence and support additional malicious activity. The worm became notable for combining classic malware delivery with social engineering on popular online communities, turning social media interactions into an effective infection channel for broader compromise.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Symantec released a threat write-up for the W32.Koobface.A worm, documenting the malware family and providing detection information.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new **Conficker** variant, also known as **Kido** or **Downadup**, reactivated infected hosts through peer-to-peer communications and resumed worm behavior by spreading between systems and downloading additional malware. Kaspersky reported that compromised machines pulled down a rogue antivirus detected as `FraudTool.Win32.SpywareProtect2009.s` and the **Waledac** email worm, detected as `Email-Worm.Win32.Iksmas.atz`, which added spam-sending and data-theft capabilities to already infected endpoints. Technical analysis and sample listings show the malware propagated through multiple channels, including exploitation of **`MS08-067`**, SMB brute forcing, and removable media using `autorun.inf` and disguised DLL files. The worm established persistence, injected into processes such as `Explorer.exe` and `Svchost.exe`, blocked DNS access to security resources, altered TCP settings, disabled protections and services, deleted restore points, and used a domain generation algorithm to maintain resilience on legacy Windows systems, particularly older **Windows XP** environments.
Aug 15, 2026
A newly disclosed **Microsoft Windows Plug and Play buffer overflow** vulnerability, tracked as `VU#998653` and addressed by Microsoft's `MS05-039` patch, was rapidly weaponized into multiple worms including **Zotob**, **RBot**, **SD-Bot**, and related IRC bot variants. The malware primarily targeted unpatched **Windows 2000** systems, disrupting high-profile organizations such as **CNN**, **The New York Times**, **ABC News**, and parts of **Capitol Hill**. Security researchers said the outbreak drew intense attention because of the prominent victims, but Internet monitoring groups and Microsoft assessed it as more localized than an Internet-wide epidemic, with **Windows XP** largely unaffected and patched or firewalled systems better protected. The incident showed how quickly exploit code could follow a patch release, with public exploits appearing within days and Zotob detected shortly afterward as attackers folded the flaw into existing bot malware. Antivirus vendors and responders urged organizations to apply patches, update signatures, isolate infected hosts, and use removal tools for the growing list of Zotob variants. Investigators later detained **Farid Essebar** in Morocco and **Atilla Ekici** in Turkey in connection with the worm campaign, while researchers said the arrests also exposed a broader underground trade in compromised PCs and shared malware source code that enabled continued variant development.
Jun 29, 2026
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026