{
  "family": "induc",
  "sample_count": 9,
  "category": "advanced_threat",
  "description": "Virus:Win32/Induc is a highly unique, fascinating, and historic file infector from 2009 that introduced a terrifying new vector for supply chain attacks. Instead of infecting random executable files, Induc specifically targeted software developers by infecting the **Delphi programming compiler** (versions 4 through 7). Once a developer's machine was infected, every single new, legitimate software program they compiled would automatically contain the Induc virus, turning innocent software vendors into unwitting malware distributors.<br><br><b>Understanding the Induc Virus</b><br>To an end-user, an Induc-infected file behaved perfectly normally, as the virus was largely benign and contained no destructive payload. For security analysts and software developers, Induc was a nightmare. It proved that trust in digitally signed, legitimate software could be fundamentally broken if the compiler itself was compromised. Countless legitimate applications worldwide were suddenly flagged as malware because their developers were infected with Induc.<br><br><b>Execution and Compiler Infection Mechanics</b><br>The infection began when a developer accidentally ran an executable that had been compiled on an already-infected machine (`T1204.002`). The virus would immediately search the registry for installations of Borland Delphi (`T1012`). If found, it navigated to the Delphi source folder and located a core library file named `SysConst.pas` (the source code for system constants). The virus injected its own malicious Delphi source code directly into `SysConst.pas` (`T1195`). It then invoked the Delphi command-line compiler to compile this modified file into a new `SysConst.dcu` (compiled unit). From that moment on, anytime the developer compiled *any* project, the Delphi linker would automatically include the malicious `SysConst.dcu`. Every output `.exe` became a carrier for the virus.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive reputational damage to software vendors and a stark lesson in supply chain vulnerability. The IoC is the presence of the Induc signature within newly compiled Delphi executables. On the developer's machine, the key IoC is a modified `SysConst.pas` file containing malicious source code, and a recently compiled `SysConst.dcu` file in the Delphi library directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1012",
    "T1195",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1195",
      "name": "Supply Chain Compromise (Infecting the development compiler)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1012",
      "name": "Query Registry (Locating the Delphi installation)",
      "tactic": "Discovery"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "For end-users: Simply delete the infected executable; the virus does not actively harm the system or steal data.",
    "For Developers: Immediately stop distributing all software compiled on the infected machine.",
    "Developers must navigate to their Delphi `Lib` directory, delete the maliciously compiled `SysConst.dcu`, and replace the `SysConst.pas` file with a clean backup from the installation media.",
    "Developers must completely recompile all software projects from clean source code to ensure the resulting binaries are free of the virus."
  ],
  "what_to_avoid": [
    "Do not assume the software vendor intentionally distributed malware; they were likely victims of the compiler infection.",
    "Avoid simply cleaning the output `.exe`; the developer's environment remains compromised and will continue to generate infected files."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}