{
  "family": "brambul",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Worm:Win32/Brambul is a network-spreading worm attributed to the Lazarus Group (North Korean state-sponsored threat actors). Brambul is designed to spread laterally across local networks and the broader internet by actively brute-forcing Server Message Block (SMB) credentials on exposed ports (`T1110.001`). It is often used as a noisy precursor or a distraction technique during more targeted attacks.<br><br><b>Understanding Brambul (SMB Brute-Forcer)</b><br>To an end-user, a Brambul infection might manifest as network sluggishness or unexpected account lockouts. For a network defender, Brambul is a highly visible, aggressive threat. It highlights poor network segmentation and the presence of weak or default administrative credentials. Because it constantly scans and attacks, it is easily detected by intrusion detection systems (IDS).<br><br><b>Execution and Spreading Mechanics</b><br>Once Brambul executes on a compromised host, it establishes persistence via the Windows Registry (`HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`). Its primary function then activates: it generates random IP addresses and attempts to connect to them via SMB (TCP port 445). If port 445 is open, the worm attempts to authenticate using a hardcoded list of common usernames and weak passwords (`T1110.001`). If successful, it copies itself to the target machine (`T1105`) and uses a scheduled task or a remote execution tool to launch the copy, continuing the cycle (`T1570`). It also emails system information back to attacker-controlled accounts.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, uncontrolled lateral movement and potential exposure of the network to follow-on Lazarus Group payloads. Network IoCs are glaring: a massive spike in outbound SMB traffic (TCP 445) to random external IP addresses and internal subnets. Host-based IoCs include EDR alerts for thousands of failed login attempts (`Event ID 4625`) originating from a single machine, followed by successful logins across the network using default credentials.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1110.001",
    "T1046",
    "T1547.001",
    "T1570"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing (Aggressively brute-forcing SMB credentials)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer (Copying itself over SMB to compromised hosts)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Scanning for open port 445)",
      "tactic": "Discovery"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate any machine generating massive amounts of outbound SMB traffic (TCP 445) to prevent further lateral movement.",
    "Implement firewall rules to strictly block outbound SMB (TCP 445) traffic from endpoints to the internet.",
    "Identify the compromised credentials used by the worm and force a global password reset for those accounts.",
    "Hunt across the network for the Brambul executable and its associated persistence registry keys, removing them enterprise-wide."
  ],
  "what_to_avoid": [
    "Do not allow SMB (TCP 445) to be accessible from the internet under any circumstances.",
    "Avoid relying on default or easily guessable local administrator passwords, which are the primary vector for this worm."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}