{
  "family": "hpdefender",
  "sample_count": 109,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Hpdefender is a deceptive family of 'scareware' or rogue security software that intentionally generates false virus alerts to extort money from users for a fake premium license.<br><br><b>What is Hpdefender?</b><br>To the panicked end-user, Hpdefender appears to be a legitimate antivirus program reporting that the machine is critically infected with dozens of severe threats. For security analysts, Hpdefender is a classic extortion scam. It provides absolutely no actual security value. Instead, it utilizes aggressive social engineering, hijacked system alerts, and locked screens to frighten the user into entering their credit card information to 'clean' the non-existent infections.<br><br><b>Infection Vectors & Threat Hunting</b><br>Hpdefender is typically distributed via drive-by downloads from malicious advertising networks or bundled with other Potentially Unwanted Programs (PUPs). Upon execution, it immediately launches a fake, highly animated 'system scan'. It establishes persistence via the Registry Run keys (<code>HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run</code>) to ensure it launches on every boot. Crucially, Hpdefender frequently terminates legitimate system utilities (like Task Manager, Registry Editor, and Command Prompt) and attempts to disable Windows Defender to prevent the user from closing the fake alerts or removing the software.<br><br><b>Forensic Analysis & Impact</b><br>The impact is user distress, potential financial loss (credit card theft), and a severely degraded endpoint. Incident responders will notice the endpoint constantly displaying full-screen, unclosable alerts. EDR platforms will flag Hpdefender for its attempts to disable built-in security tools (<code>T1562.001</code>). Network logs will show the software reaching out to its affiliate payment portals.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1491.001",
    "T1189",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Boot the infected machine into Windows 'Safe Mode' to bypass the Hpdefender startup routine and regain access to the desktop.",
    "Utilize a known-good, offline AV scanner or specialized anti-malware tool (like Malwarebytes) to identify and remove the rogue executables.",
    "Audit the Windows Registry and restore access to Task Manager (<code>DisableTaskMgr</code>) and Registry Editor (<code>DisableRegistryTools</code>).",
    "If the user entered their credit card information into the fake software, advise them to immediately contact their bank to cancel the card."
  ],
  "what_to_avoid": [
    "Do not allow the user to pay for the 'premium' license; the software is entirely fake and will not clean the system.",
    "Avoid assuming the system is completely clean after removing the rogue AV; scareware is frequently dropped by more severe exploit kits."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}