Loading story…
Rustock operated as a stealthy Windows rootkit and modular spam bot that injected its spam component into services.exe, used encrypted HTTP POST traffic for command-and-control, and protected those exchanges with RC4 after a key-exchange phase. Reverse-engineering showed the malware could profile infected hosts, kill competing malware, download spam templates and recipient lists, retrieve mail-server targets and SMTP failure strings, and update itself while remaining difficult to detect. Public sample collections and analysis links document multiple variants including Rustock.C, Rustock.E, Rustock.I, Rustock.J, and related builds observed across several years.
Investigators later tied parts of Rustock’s infrastructure to financially motivated spam operations, including counterfeit-drug promotions linked to the SpamIt and Rx-Promotion affiliate programs and pump-and-dump stock campaigns. After Microsoft seized dozens of U.S.-hosted command-and-control servers, reporting traced hosting payments to a WebMoney account associated with a person identified as Vladimir Shergin in Saint Petersburg, though definitive attribution remained unresolved. Separate monitoring of the botnet’s spam runs showed how operators could profit by promoting thinly traded penny stocks, with one observed campaign driving heavy trading and a sharp price increase after millions of spam emails were sent.
Pull IOCs and campaign context straight into your stack.
16 events from the most recent confirmed update back to the earliest known activity.
The rogue pharmacy affiliate program SpamIt shut down in September 2010 after its alleged leader came under scrutiny from Russian authorities. Later Rustock reporting tied a WebMoney account associated with suspected Rustock infrastructure to top SpamIt affiliates.
Records from the rogue pharmacy program Rx-Promotion showed that Cosma2k, Bird, and Adv1 collectively earned about $200,000 in commissions in 2010. The same accounts were registered there using the same ICQ account, reinforcing links among the affiliates.
SpamIt records showed that the affiliate account Bird generated more than $130,000 in pharmacy sales in January 2010, exceeding the next most successful affiliate at about $86,000. Later reporting linked Bird to the same identifiers associated with suspected Rustock operators.
VirusTotal first saw the Rustock 23 sample on November 7, 2009. The sample is identified by MD5 1A713083A0BC21BE19F1EC496DF4E651.
VirusTotal first saw the Rustock.I sample on October 7, 2009. The sample is identified by MD5 4A5E58D6351C342F3EDC145F6F4EEAFE.
A sample labeled Rustock 23 was timestamped on October 1, 2009. The sample is listed with MD5 1A713083A0BC21BE19F1EC496DF4E651.
A Rustock.I sample was timestamped on September 15, 2009. The sample is listed with MD5 4A5E58D6351C342F3EDC145F6F4EEAFE.
VirusTotal first saw the Rustock.NFE sample on March 20, 2009. This sample is identified by MD5 8E4994543ADBC2BA2103C6F801898356.
A Rustock.NFE sample was timestamped on March 2, 2009. The sample is listed with MD5 8E4994543ADBC2BA2103C6F801898356.
VirusTotal first saw a Rustock.J sample on August 22, 2008. The sample is identified by MD5 76101675D9CF5BA5238CAE9D5FAC8881.
A Rustock.E sample was timestamped on September 26, 2007. The sample is listed with MD5 04BA40662923BE168CA4DC2DA924A0D0.
VirusTotal first saw the Rustock.C sample on January 22, 2007. The sample is identified by MD5 FDAFB3A14338B2B612C4E5C4F94B3677.
A Rustock.C sample with MD5 FDAFB3A14338B2B612C4E5C4F94B3677 was timestamped on January 19, 2007. This is the same lzx32.sys variant later analyzed in the USENIX case study.
After the takedown, investigators found that about one-third of the Rustock control servers had been rented through an Eastern European reseller and paid for via WebMoney purse Z166284889296. A former law enforcement officer said the attested account was in the name Vladimir Shergin, and the same payment identifier was linked to top SpamIt and Rx-Promotion affiliates.
Microsoft disrupted the Rustock botnet by obtaining a court order and seizing dozens of command-and-control servers hosted by U.S.-based providers. The servers had been coordinating hundreds of thousands of infected PCs and distributing updates and spam instructions.
Ken Chiang and Levi Lloyd published a reverse-engineering case study of Rustock that detailed its rootkit loader, spam-module extraction, RC4-protected HTTP C2, and injection into services.exe. The work also showed how decrypted sessions revealed commands for killing competing malware, profiling hosts, and retrieving spam infrastructure data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourcecontagiodump.blogspot.com
Open sourcekrebsonsecurity.com
Open sourceusenix.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Trojan.Srizbi** as a highly sophisticated Windows **kernel-mode** spam bot and rootkit that spread through drive-by web attacks using injected malicious IFRAMEs on legitimate sites, which redirected victims to exploit kits including **MPack** and **n404**. Once installed, Srizbi loaded a kernel driver, hid files and registry entries, bypassed security hooks, and used a private TCP/IP stack with low-level **NDIS** hooks to communicate directly with HTTP-based command-and-control servers from ring 0, helping it evade personal firewalls and maintain resilient spam operations. Further investigation tied Srizbi to large-scale spam activity, including the late-October **"Ron Paul"** email campaign, which analysts concluded was sent by an existing botnet rather than a purpose-built political network. Distinctive email header fingerprints, thousands of sending IPs, and seized controller software linked the operation to the **Reactor Mailer** spam platform run by a spammer known as **`spm`**, with the campaign attributed to an account named **`nenastnyj`**; researchers also found that Srizbi could remove competing rootkits such as **Rustock.B** and **Pandex**, and published detection guidance including **Snort** signatures for its network traffic.
Aug 15, 2026
Multiple campaigns are using phishing emails and archive-based lures to deliver remote access malware through stealthy, multi-stage infection chains. Point Wild documented **Remcos RAT**, **DesckVB RAT**, and a Rust-based **COVERT RAT** being delivered through ZIP attachments, weaponized `LNK` files, obfuscated JavaScript droppers, and hidden PowerShell execution, often with decoy documents to mask activity. The payloads were loaded filelessly through .NET reflection and in-memory execution, with operators abusing legitimate binaries and services such as `aspnet_compiler.exe`, GitHub, and paste or web-hosting platforms to stage malware while evading detection. Reported command-and-control infrastructure included `192.3.27.141:8087`, `172.245.246.77:8080`, and `181.231.253.69:4444`, while observed artifacts included `C:\ProgramData\remcos\logs.dat`, `C:\ProgramData\colors\logs.dat`, and payload names such as `ALTERNATE.dll`, `ClassLibrary3.dll`, `Keylogger.dll`, and `msedge_proxy.exe`. Separate reporting showed the same tradecraft extending beyond custom RATs to commodity remote-access software and credential theft. A campaign targeting Russian aerospace and aviation organizations used invoice-themed phishing and spoofed domains to install a portable **AnyDesk** instance for unattended access, maintain persistence with a scheduled task, minimize visibility with Tray Minimizer, and exfiltrate configuration data through a command-line SMTP mailer; Seqrite linked the activity to **Rare Werewolf (Librarian Ghouls)**. Securonix research cited by Trojan Killer described **VEIL#DROP** using fake document-style JavaScript files, Blogspot-hosted staging, PowerShell download cradles, XOR decoding, and in-memory .NET loading to deploy **PureLog Stealer**, which targets browser credentials, cookies, session tokens, wallet data, and host information. Across the campaigns, the common pattern is phishing-led initial access followed by LOLBins, PowerShell, staged downloads, persistence, and covert data theft or long-term remote control.
Jul 12, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026