{
  "family": "dorkbot",
  "sample_count": 86,
  "category": "botnet",
  "description": "Dorkbot is a botnet that, according to a U.S. CISA Technical Alert (TA15-337A) issued by DHS in collaboration with the FBI and Microsoft, is used to steal online payment and account credentials, participate in distributed denial-of-service (DDoS) attacks, and deliver additional malware to infected computers. Microsoft reported that the malware family behind the botnet infected more than one million computers across over 190 countries. Dorkbot commonly spreads through malicious links sent over social networks and instant-messaging programs, and through infected USB devices. Its backdoor functionality lets a remote attacker download and run files, harvest stored credentials via form grabbing and from FTP, POP3, and browser-cached logins, and block or redirect selected websites such as security vendors' sites.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Dorkbot",
    "NgrBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Dorkbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dorkbot is a botnet. As described in the CISA alert TA15-337A, infected systems are used to steal credentials and online payment information, launch DDoS attacks, and download additional malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dorkbot spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "According to CISA, Dorkbot commonly spreads through malicious links sent via social networks and instant-messaging programs, and through infected USB devices that use the Windows Autorun feature."
      }
    },
    {
      "@type": "Question",
      "name": "What can a Dorkbot infection do to a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dorkbot has backdoor functionality. CISA notes a remote attacker may download and run files, collect logon information through form grabbing and from FTP, POP3, and cached browser logins, and block or redirect specific websites, including security sites."
      }
    },
    {
      "@type": "Question",
      "name": "How widespread was Dorkbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The CISA alert cites Microsoft analysis stating the malware family behind the botnet infected more than one million computers in over 190 countries."
      }
    },
    {
      "@type": "Question",
      "name": "What information does Dorkbot try to steal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Per CISA, Dorkbot harvests sensitive information such as user account credentials and online banking details, and infected systems can also be used to send spam."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1185",
    "T1071.001"
  ],
  "cisa_advisory": "TA15-337A",
  "last_updated": "2026-06-11",
  "sources": [
    {
      "name": "CISA Alert TA15-337A: Dorkbot (DHS, FBI, Microsoft)",
      "url": "https://www.cisa.gov/news-events/alerts/2015/12/03/dorkbot"
    }
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}