{
  "family": "kelvir",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nKelvir is a widespread and aggressive family of Worms that primarily propagate by exploiting instant messaging networks, most notably the legacy MSN Messenger (Windows Live Messenger) platform. Emerging in the mid-2000s, Kelvir rapidly infected millions of computers globally. By hijacking the victim's IM client and leveraging social engineering, Kelvir rapidly spreads across contact lists, degrading network performance and often dropping secondary backdoor trojans.\n\n<h3>Propagation and Execution Lifecycle</h3>\nKelvir relies on aggressive, largely automated propagation techniques utilizing social engineering:\n<ul>\n<li><strong>Instant Messaging Propagation (Worm Capability):</strong> Upon execution, Kelvir hooks into the active MSN Messenger process. It automatically sends a malicious link to every contact in the infected user's active contact list. The message often uses enticing social engineering (e.g., \"lol check out this picture of you!\") to trick the recipient into clicking the link.</li>\n<li><strong>Payload Delivery:</strong> The link directs the recipient to a compromised web server that automatically downloads the Kelvir executable (often disguised as a `.scr`, `.pif`, or `.zip` file). If the new victim executes the file, the cycle repeats.</li>\n<li><strong>System Sabotage and Backdoors:</strong> Once active, Kelvir attempts to disable local antivirus and firewall software. Crucially, many Kelvir variants carry a secondary payload—often a botnet agent or a backdoor trojan (like Spybot)—allowing the attacker to remotely control the infected machine, steal credentials, or launch DDoS attacks.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the specific MSN Messenger platform is obsolete, the propagation mechanics of Kelvir (abusing trusted communication channels) remain highly relevant today (e.g., spreading via Slack, Teams, or WhatsApp). An infection represents a significant security incident, as the rapid propagation can overwhelm network bandwidth and the secondary payloads compromise endpoint integrity.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Aggressive Network Isolation:</strong> Infected machines must be immediately disconnected from the LAN to halt the outbound IM spam traffic and prevent further lateral spread.</li>\n<li><strong>Application Control and Web Filtering:</strong> In modern environments, implement strict web filtering (SWG) to block the download of executable file types from unknown domains, neutralizing the worm's primary delivery mechanism.</li>\n<li><strong>Behavioral EDR:</strong> Defenses must rely on heuristic EDR tools that detect anomalous actions (e.g., an IM client process unexpectedly attempting to download and execute secondary binaries, or modifications to the Windows `HOSTS` file).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Win32.Kelvir",
    "IM-Worm.Kelvir",
    "W32/Kelvir"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1562.001",
    "T1059"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T16:48:23Z",
  "type": "Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}