{
  "family": "elex",
  "sample_count": 31,
  "category": "adware",
  "description": "Adware:Win32/Elex is a highly pervasive and aggressive family of adware and browser hijackers. It is typically distributed through software bundling, where it is silently installed alongside free software downloaded from third-party sites. Once active, Elex modifies browser shortcuts, alters default search engine settings, and hijacks the homepage to forcefully redirect web traffic through advertiser networks. It often injects intrusive advertisements, pop-ups, and sponsored links into legitimate web pages. To prevent easy removal, Elex frequently employs defense evasion techniques, such as deploying scheduled tasks, creating hidden services, or utilizing rootkit-like behaviors to constantly restore its components if a user attempts to delete them.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "high",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1053.005",
    "T1189",
    "T1562.001",
    "T1546",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use specialized anti-adware and anti-malware utilities (e.g., Malwarebytes, AdwCleaner) to root out persistent registry keys and hidden files.",
    "Manually inspect and repair modified web browser shortcuts (checking the 'Target' field for appended malicious URLs).",
    "Reset affected web browsers to their default settings to clear malicious extensions and hijacked search engine configurations.",
    "Audit Windows Scheduled Tasks for suspicious entries designed to reinstall Elex."
  ],
  "what_to_avoid": [
    "Do not download software from untrusted third-party aggregators, and always opt for 'Custom' or 'Advanced' installation to decline bundled offers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}