{
  "family": "itorrent",
  "sample_count": 4,
  "category": "advanced_threat",
  "description": "Adware:Win32/Itorrent (often classified as PUA or Riskware) is an adware application typically bundled with, or disguised as, a free BitTorrent client. While it may provide the advertised peer-to-peer file-sharing functionality, its primary purpose is to heavily monetize the user's system by injecting intrusive advertisements, hijacking browser search settings, and tracking user behavior, often downloading secondary nuisance software without explicit consent.<br><br><b>Understanding Itorrent (Adware/PUA)</b><br>To an end-user, Itorrent appears to be a legitimate tool for downloading movies or software via the BitTorrent protocol. However, the user quickly experiences a degraded system performance, browser slowdowns, and a constant barrage of pop-up ads. For a network administrator, it represents a dual threat: the high bandwidth consumption and legal liability of P2P file sharing, combined with the security risks of adware and browser hijacking.<br><br><b>Execution and Monetization Mechanics</b><br>Itorrent is usually acquired when users search for free torrent clients and download from third-party aggregation sites instead of official repositories (`T1189`). The installer utilizes 'Dark Patterns' to trick the user into accepting bundled software (`T1036`). Upon execution (`T1204.002`), it installs the torrent client but also establishes persistence for its adware components (often via Scheduled Tasks or Registry Run keys) (`T1547.001`). It installs persistent browser extensions or modifies browser shortcut properties (`T1176`) to intercept web traffic, injecting sponsored links into search results and redirecting the user to affiliate marketing pages (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a degraded user experience, unauthorized tracking, and potential exposure to malvertising. Host-based IoCs include EDR alerts for unexpected additions to browser extension directories, modifications to `LNK` shortcut files, and anomalous processes communicating with known adware tracking domains. Network IoCs include a mix of standard BitTorrent traffic (heavy UDP/TCP on high ports) mixed with HTTP/HTTPS connections to ad-serving networks.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1176",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Installing malicious adware extensions)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Browser hijacking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Deceptive software bundling)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to thoroughly uninstall the 'Itorrent' application and any explicitly named adware toolbars that were bundled with it.",
    "Remove any unknown or recently installed browser extensions from Chrome, Edge, Internet Explorer, and Firefox.",
    "Reset all installed web browsers to their factory default settings to clear out hijacked homepages and search engines.",
    "Implement network-level blocking of the BitTorrent protocol (if against corporate policy) and known adware domains."
  ],
  "what_to_avoid": [
    "Do not allow the use of unapproved P2P file-sharing applications on corporate networks, as they are a primary vector for malware and data leakage.",
    "Avoid simply changing the homepage back manually; if the Itorrent extension is still present, the changes will revert on the next launch."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}