{
  "family": "kido",
  "sample_count": 5,
  "category": "advanced_threat",
  "description": "Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in history. First detected in late 2008, it rapidly infected millions of Windows computers globally, including critical government, military, and corporate infrastructure. It is famous for its aggressive self-propagation mechanisms, its pioneering use of a Domain Generation Algorithm (DGA) for command-and-control, and its ability to completely disable Windows security services.<br><br><b>Understanding the Conficker (Kido) Worm</b><br>To an end-user, a Conficker infection might result in the inability to access security vendor websites (e.g., microsoft.com, symantec.com) and account lockouts. For a network administrator, Conficker is a nightmare; it causes massive network congestion due to its aggressive scanning and creates a highly resilient botnet capable of receiving arbitrary payloads from its masters. It proved how devastating a worm utilizing a known, unpatched vulnerability could be.<br><br><b>Execution and Unprecedented Spreading Mechanics</b><br>Conficker primarily spreads by exploiting **MS08-067**, a critical vulnerability in the Windows Server service (`T1210`). It actively scans the local subnet and the internet for unpatched machines, sending a crafted RPC request that triggers a buffer overflow, allowing it to execute code remotely and install itself without user interaction. It also spreads via USB drives using deceptive `autorun.inf` files (`T1091`) and attempts to brute-force network file shares using weak administrator passwords (`T1110.001`). Once installed, it drops itself as a randomly named DLL (e.g., `C:\\Windows\\System32\\xxyyzz.dll`) and registers itself as a hidden Windows service (`svchost.exe`) (`T1543.003`). To prevent removal, it terminates AV processes, blocks access to security websites via DNS poisoning, and disables Windows AutoUpdate (`T1562.001`). Crucially, to receive updates and commands, later variants generated up to 50,000 pseudo-random domain names a day (DGA), making it incredibly difficult for authorities to sinkhole the C2 infrastructure (`T1568.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was the creation of the largest botnet in history at the time, and severe network disruption. Host-based IoCs include EDR alerts for anomalous DLLs loading into `svchost.exe` (specifically the `netsvcs` group), the inability to access Windows Update, and sudden Account Lockout events across the domain as the worm attempts lateral movement. Network IoCs include massive spikes in outbound port 445 (SMB) traffic (scanning) and thousands of DNS requests for non-existent, randomly generated domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1210",
    "T1091",
    "T1562.001",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services (MS08-067 / SMB)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms (DGA)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Disabling AV and Windows Update)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB autorun)",
      "tactic": "Lateral Movement"
    }
  ],
  "containment_steps": [
    "Isolate infected segments immediately; Conficker spreads autonomously at high speed via SMB over the local network.",
    "Ensure the MS08-067 patch (and all subsequent critical SMB patches) is applied universally across the enterprise.",
    "Implement strong Account Lockout policies and ensure local Administrator passwords are unique across all workstations (e.g., using Microsoft LAPS) to halt SMB brute-forcing.",
    "Use specialized Conficker removal tools, as the worm aggressively defends itself against manual removal and standard AV scans."
  ],
  "what_to_avoid": [
    "Do not assume the network is clean until every single machine has been verified and patched; a single unpatched machine will re-infect the entire network.",
    "Avoid leaving default open file shares or weak passwords on network drives, as Conficker will rapidly exploit them to spread."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}