{
  "family": "hamweq",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nHamweq (often associated with the extensive IRCBot or AutoRun worm families) is a self-replicating malicious Worm and Botnet agent. Designed to rapidly propagate across local networks and removable media, Hamweq compromises Windows systems, establishes persistence, and connects the infected host to a centralized Internet Relay Chat (IRC) command-and-control server, awaiting instructions from the botmaster.\n\n<h3>Propagation and Execution Lifecycle</h3>\nHamweq relies on aggressive, largely automated propagation techniques:\n<ul>\n<li><strong>Removable Media (Worm Capability):</strong> Hamweq's primary vector is exploiting the Windows AutoRun feature. It copies itself to any attached USB flash drives or external hard drives and creates a malicious `autorun.inf` file. When the drive is inserted into a new, vulnerable computer, the OS automatically executes the worm.</li>\n<li><strong>Network Shares:</strong> The worm actively scans the local area network (LAN) for weakly secured or open network shares (SMB) and attempts to copy its payload into those directories to spread laterally.</li>\n<li><strong>IRC Botnet Integration:</strong> Once a host is infected, Hamweq modifies the registry (e.g., `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run`) for persistence. It then reaches out to a hardcoded IRC server, joining a specific, hidden channel to receive commands.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Hamweq infection is a significant security incident. While older, its worm capabilities allow it to rapidly contaminate an entire enterprise environment. Once connected to the IRC botnet, the compromised machines can be instructed to download secondary malware (like ransomware), harvest credentials, or participate in distributed denial-of-service (DDoS) attacks.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Due to its self-replicating nature, infected machines must be immediately physically disconnected from the LAN to halt lateral movement via network shares.</li>\n<li><strong>Disable AutoRun:</strong> The immediate enterprise-wide remediation is to ensure that the Windows AutoRun/AutoPlay feature is completely disabled via Group Policy (GPO) for all removable media.</li>\n<li><strong>Network Traffic Analysis:</strong> Monitor edge firewalls for anomalous IRC traffic (typically TCP ports 6667-6669) to identify all hosts that have successfully connected to the Hamweq C2 infrastructure.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Hamweq",
    "IRC.Hamweq",
    "Win32/Hamweq"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1059",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:44:41Z",
  "type": "Worm / Botnet",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}