{
  "family": "kelihos",
  "sample_count": 47,
  "category": "spam_bot",
  "description": "Worm:Win32/Kelihos (also known as Hlux) is a massive, highly resilient peer-to-peer (P2P) botnet that emerged around 2010. It is infamous for its aggressive spam campaigns, credential theft, and its ability to rapidly recover from numerous high-profile takedown attempts by law enforcement and security researchers.<br><br><b>Understanding Kelihos (Hlux)</b><br>To the end-user, a Kelihos infection might be invisible, or it might result in performance issues as the machine blasts out thousands of spam emails. For threat intelligence analysts, Kelihos is a masterclass in botnet resilience. Unlike traditional botnets that rely on centralized Command and Control (C2) servers (a single point of failure), Kelihos utilizes a decentralized P2P architecture. Every infected machine acts as a node, capable of sharing instructions and updates with other infected machines, making it incredibly difficult to decapitate.<br><br><b>Execution and Evasion Strategies</b><br>Kelihos is primarily distributed via massive spam campaigns containing malicious links or attachments. Upon execution, the malware establishes persistence via the Registry Run keys. It communicates over custom UDP and TCP protocols to discover other peers in the botnet. The botnet is highly modular; the controllers can push updates to turn nodes into spam relays (advertising pharmaceuticals or pump-and-dump stocks), proxy servers (`T1090`), or credential harvesters. It actively intercepts network traffic (`T1056.004`) to steal FTP, email, and browser passwords. It also utilizes fast-flux DNS to hide its few centralized routing nodes.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a hijacked endpoint contributing to global cybercrime infrastructure. EDR platforms will flag the malware injecting into system processes (`svchost.exe`) to mask its network activity (`T1055`). Network logs will reveal massive spikes in outbound SMTP (TCP 25) traffic or constant, encrypted UDP communication with a rotating list of seemingly random IP addresses (P2P traffic).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1114.001",
    "T1090.003",
    "T1056.004",
    "T1568.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Collection"
    },
    {
      "id": "T1568.001",
      "name": "Dynamic Resolution: Fast Flux DNS",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt its participation in massive outbound spam campaigns or its use as a malicious proxy.",
    "Enforce strict egress firewall rules, particularly focusing on blocking the unauthorized UDP ports utilized by the P2P communication protocol.",
    "Capture a forensic memory image to analyze the active Kelihos payload and identify the IP addresses of the peer nodes it is communicating with.",
    "Assume all locally saved credentials have been harvested; initiate mandatory password resets for the compromised user."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'minor spam issue'; the botnet controllers have full remote code execution capabilities on the endpoint.",
    "Avoid relying solely on static IP blacklists for defense; Kelihos's P2P architecture and fast-flux DNS render them largely ineffective."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}