{
  "family": "allaple",
  "sample_count": 341,
  "category": "worm",
  "description": "Worm:Win32/Allaple is a highly aggressive, polymorphic network worm notorious for rapidly propagating across Local Area Networks (LANs) and causing severe network congestion and Denial of Service (DoS).<br><br><b>What is Allaple?</b><br>For general users, an Allaple infection results in a severely sluggish computer and an unusable network connection. For incident responders, Allaple is a classic, catastrophic network threat. Unlike modern, stealthy malware, Allaple is incredibly noisy. Once it infects a host, it immediately begins violently scanning the local subnet and external IP ranges, attempting to exploit known vulnerabilities (such as older DCOM RPC or SMB exploits) to replicate itself onto as many machines as possible.<br><br><b>Infection Vectors & Threat Hunting</b><br>Allaple is a self-propagating worm. Once a single machine on a network is infected (often via a malicious email attachment or compromised USB drive), the worm takes over. It utilizes advanced polymorphism; every time it replicates, it changes its file size, code structure, and icon to evade static antivirus signatures. Threat hunters will instantly identify an Allaple outbreak by observing massive, sustained spikes in outbound TCP traffic on ports 135, 139, 445, and various random high ports. The infected host effectively acts as a localized DoS attack against the corporate firewall and switches.<br><br><b>Forensic Analysis & Impact</b><br>The impact of Allaple is network paralysis. EDR platforms frequently detect Allaple based on its aggressive network scanning and attempts to drop randomly named, polymorphic executables into the <code>%SystemRoot%</code> directory. Incident responders must utilize network segmentation immediately to quarantine the infected subnets, as the worm will spread faster than manual remediation can occur.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1027",
    "T1210",
    "T1498",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately physically disconnect the infected endpoint from the network switch; Allaple will paralyze the local subnet with scan traffic.",
    "Deploy network segmentation and firewall rules to block lateral traffic on TCP ports 135, 139, and 445 to halt the worm's propagation.",
    "Utilize a reputable, updated antivirus scanner to remove the polymorphic Allaple executables from the <code>%SystemRoot%</code> directory.",
    "Ensure all machines on the network are fully patched against historical DCOM RPC and SMB vulnerabilities to prevent reinfection."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the sheer volume of outbound scanning will crash corporate routers.",
    "Avoid relying solely on file hashes (MD5/SHA-256) to hunt for Allaple; its polymorphism ensures every dropped executable is unique."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}