Loading story…
A new Conficker variant, also known as Kido or Downadup, reactivated infected hosts through peer-to-peer communications and resumed worm behavior by spreading between systems and downloading additional malware. Kaspersky reported that compromised machines pulled down a rogue antivirus detected as FraudTool.Win32.SpywareProtect2009.s and the Waledac email worm, detected as Email-Worm.Win32.Iksmas.atz, which added spam-sending and data-theft capabilities to already infected endpoints.
Technical analysis and sample listings show the malware propagated through multiple channels, including exploitation of MS08-067, SMB brute forcing, and removable media using autorun.inf and disguised DLL files. The worm established persistence, injected into processes such as Explorer.exe and Svchost.exe, blocked DNS access to security resources, altered TCP settings, disabled protections and services, deleted restore points, and used a domain generation algorithm to maintain resilience on legacy Windows systems, particularly older Windows XP environments.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
During the night of 8/9 April 2009, machines infected with Trojan-Downloader.Win32.Kido/Conficker.c contacted each other over peer-to-peer communications. Those instructions activated the Kido botnet and directed infected systems to download new malicious files.
Kaspersky said the Iksmas/Waledac malware was first detected in January 2009, and that many IT experts noted similarities between Kido and Iksmas at that time. It also said an email epidemic of similar scale to Kido was caused by Iksmas.
Initial analysis suggested the new Kido variant had date-limited functionality until 3 May 2009. This was Kaspersky's assessment of the malware's operational window.
Kaspersky Lab announced detection of a new Kido/Conficker variant and said it was conducting detailed analysis. The company also said its experts were working on a new version of the KKiller utility to handle the worm's latest functionality, and that its products detected the threat heuristically.
Kaspersky's analysis found the new Kido/Conficker variant again functioned as a worm and downloaded additional malware onto compromised systems. The payloads included the rogue antivirus FraudTool.Win32.SpywareProtect2009.s from websites in Ukraine and the Waledac email worm, detected as Email-Worm.Win32.Iksmas.atz.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcecontagiodump.blogspot.com
Open sourcekaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Emotet** re-emerged after the 2021 law-enforcement disruption and rebuilt its botnet through large-scale phishing and thread-hijacking campaigns that delivered malicious Office files, password-protected ZIPs, LNK files, and later OneNote lures. Across these waves, victims were tricked into enabling macros or opening shortcut-based droppers that launched obfuscated PowerShell, `mshta.exe`, JavaScript, or Excel 4.0/XLM macros to fetch Emotet DLLs from rotating lists of compromised websites, often executing them through `regsvr32.exe` or `rundll32.exe`. Researchers reported campaigns targeting millions of email addresses, with notable concentration in Japan and Italy, and observed operators adapting quickly as Microsoft blocked Internet-sourced VBA macros by default. The revived malware also introduced significant technical changes while preserving its role as an information stealer and malware delivery platform. Analysts documented a shift to 64-bit modules, stronger runtime obfuscation, updated loaders, and a move from older RSA-based protections to elliptic-curve cryptography with encrypted HTTP command-and-control traffic. Emotet continued harvesting host data, credentials, Outlook and Thunderbird email content, and Chrome-stored payment information, while restoring modules such as its SMB spreader to move laterally and using infected systems as spam bots. Multiple reports also linked Emotet to follow-on payload delivery including **IcedID**, **QakBot**, **Cobalt Strike**, **SystemBC**, **XMRig**, and ransomware-enabling access, underscoring its renewed position as a resilient initial-access and malware-as-a-service threat.
Aug 15, 2026
QAKBOT resumed large-scale email spam activity after a roughly three-month pause, using hijacked email threads and malicious attachments to reestablish itself as an initial-access malware operation often seen before ransomware deployment. Researchers linked the activity to the distributor **TR**, which has also been associated with **SquirrelWaffle** delivery and reported **IMAP brute-force** operations, underscoring the role of spam-driven access brokers in broader intrusion chains. The renewed campaign introduced changes from earlier QAKBOT waves by combining **VBA macros** with **Excel 4.0 macros** in weaponized documents. The infection chain extracted embedded data, built a command to download a QAKBOT DLL from remote hosts, executed it through **`regsvr32.exe`** using the **`-silent`** parameter, and established persistence with a scheduled task. The malware has historically served as a precursor to ransomware incidents involving **MegaCortex, PwndLocker, Egregor, ProLock,** and **Sodinokibi/REvil**.
Aug 15, 2026
Researchers reported that **KBOT** is an active Windows file-infector that spreads by injecting polymorphic malicious code into `EXE` and `DLL` files on local disks, removable media, and network shares, giving it worm-like propagation across infected environments. Once launched, the malware establishes persistence through Startup registry entries and Task Scheduler, uses DLL hijacking and process injection to embed itself in system and browser processes, and communicates with command-and-control infrastructure over encrypted channels. The malware also deploys web injects to steal banking and personal data, downloads additional stealer modules, and stores components and exfiltrated information in encrypted virtual storage. Researchers said KBOT goes beyond credential theft by modifying Remote Desktop settings to permit multiple concurrent sessions and creating a user account for remote access, combining **file infection, financial theft, stealthy persistence, and attacker-controlled administration** in a single threat.
Aug 14, 2026