{
  "family": "fosniw",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nFosniw is a hybrid threat that combines the persistence and payload delivery mechanisms of a Trojan with the rapid propagation capabilities of a network worm. It is engineered to infiltrate a network, rapidly spread across open shares and vulnerable systems, and establish a backdoor or download secondary malware, making it highly disruptive in poorly segmented enterprise environments.\n\n<h3>Propagation and Execution Lifecycle</h3>\nFosniw utilizes a multi-pronged approach to maximize its infection radius within an organization.\n\nIts execution lifecycle relies on exploiting network trust and weak security postures:\n<ul>\n<li><strong>Network Share Exploitation:</strong> The primary propagation method for Fosniw involves aggressively scanning the local area network (LAN) for open Server Message Block (SMB) network shares. It attempts to brute-force weak administrator credentials or exploit unpatched SMB vulnerabilities to copy its executable to adjacent servers and workstations.</li>\n<li><strong>System Modification and Hiding:</strong> Once resident on a new host, the worm copies itself to the Windows System directory and modifies the Registry (e.g., `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) to ensure it executes upon every reboot. It frequently alters system policies to disable Task Manager and Registry Editor to hinder manual removal.</li>\n<li><strong>Trojan Functionality:</strong> After establishing persistence and continuing its lateral movement, Fosniw connects to a command-and-control (C2) server. It typically acts as a downloader, receiving instructions to pull down and execute secondary payloads, which range from cryptominers to destructive ransomware.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Fosniw infection is highly disruptive. Because of its worm capabilities, a single infected endpoint can lead to a cascading failure, compromising hundreds of machines across the enterprise within minutes. The ability of the C2 server to deploy secondary malware elevates this to a critical risk requiring immediate containment.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the initially infected machine. Physically or logically segment the affected VLAN to halt the lateral spread of the worm via SMB.</li>\n<li><strong>Credential Auditing:</strong> The worm's ability to spread implies weak or default passwords on network shares. Conduct an immediate audit of service accounts and administrative credentials, enforcing complex passwords.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Conduct a massive forensic sweep across all endpoints and network shares to identify the Fosniw executable, remove its persistence mechanisms, and ensure no secondary payloads were deployed prior to containment.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Fosniw",
    "Trojan.Fosniw",
    "W32/Fosniw"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1547.001",
    "T1059",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:04:40Z",
  "type": "Worm / Trojan",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}