Loading story…
A newly disclosed Microsoft Windows Plug and Play buffer overflow vulnerability, tracked as VU#998653 and addressed by Microsoft's MS05-039 patch, was rapidly weaponized into multiple worms including Zotob, RBot, SD-Bot, and related IRC bot variants. The malware primarily targeted unpatched Windows 2000 systems, disrupting high-profile organizations such as CNN, The New York Times, ABC News, and parts of Capitol Hill. Security researchers said the outbreak drew intense attention because of the prominent victims, but Internet monitoring groups and Microsoft assessed it as more localized than an Internet-wide epidemic, with Windows XP largely unaffected and patched or firewalled systems better protected.
The incident showed how quickly exploit code could follow a patch release, with public exploits appearing within days and Zotob detected shortly afterward as attackers folded the flaw into existing bot malware. Antivirus vendors and responders urged organizations to apply patches, update signatures, isolate infected hosts, and use removal tools for the growing list of Zotob variants. Investigators later detained Farid Essebar in Morocco and Atilla Ekici in Turkey in connection with the worm campaign, while researchers said the arrests also exposed a broader underground trade in compromised PCs and shared malware source code that enabled continued variant development.
See affected versions and whether adversaries are exploiting it.
9 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting said security researchers connected the detained Zotob suspect's 'Diabl0' signature to more than 20 malware samples, including Mytob and MyDoom variants. Analysts noted that multiple actors likely continued producing related variants even after the arrests.
Authorities detained Farid Essebar in Morocco and Atilla Ekici in Turkey in connection with the Zotob worm case. Investigators alleged Essebar, using the handle 'Diabl0,' created Zotob for Ekici, and researchers linked the alias to numerous other malware samples.
Researchers from vendors including Trend Micro, McAfee, F-Secure, Sophos, and Symantec reported that several malware families and variants—such as Zotob, RBot, SD-Bot, IRC-Bot, CodBot, and Bozori—were exploiting the same flaw. Analysts and Microsoft assessed the incident as serious but relatively localized rather than a broad Internet-wide catastrophe.
Symantec published a dedicated W32.Zotob removal tool and updated it repeatedly between August 15 and August 26 to detect and remove additional Zotob variants. The company advised disconnecting infected machines, restricting shared folders, and running the tool with administrative privileges.
Multiple worms exploiting the Windows vulnerability infected high-profile organizations including CNN, The New York Times, and reportedly ABC News. CNN said its Windows 2000-based network disruption was severe enough to force programming changes, while other reports also cited impacts on Capitol Hill systems.
F-Secure discovered Zotob, one of several worms exploiting the Windows Plug and Play vulnerability. Zotob became the most prominent malware family associated with the outbreak.
As exploit activity increased, the SANS Internet Storm Center raised its InfoCon alert level to yellow, signaling elevated concern around attacks targeting the newly disclosed Windows flaw. This reflected growing evidence of active exploitation attempts.
Exploit code for the Plug and Play vulnerability began circulating within days of Microsoft's patch release, enabling bot and worm authors to weaponize the flaw quickly. Later reporting cited this rapid exploit availability as a key factor in the ensuing outbreak.
Microsoft released security bulletin MS05-039 for a buffer overflow vulnerability in Windows Plug and Play that affected older Windows systems, including Windows 2000. CERT/CC also published advisory VU#998653 on the issue.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcenews.bbc.co.uk
Open sourcenews.bbc.co.uk
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcekb.cert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026
Attackers rapidly weaponized **Atlassian Confluence** vulnerability `CVE-2021-26084`, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the **z0Miner** botnet, which had previously spread through **WebLogic, Elasticsearch, and Jenkins** flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed **XMRig** miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts. Security researchers also observed broader exploitation beyond z0Miner, including **Muhstik**, **Sysrv-Hello**, **Setag**, **BillGates**, and **Dofloo**-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port `23733`. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
Aug 14, 2026