{
  "family": "koobface",
  "sample_count": 12,
  "category": "advanced_threat",
  "description": "Worm:Win32/Koobface (an anagram of Facebook) was one of the most prolific and highly profitable botnets in history, peaking between 2008 and 2012. Koobface was unique because its primary infection vector was not email or exploit kits, but rather highly sophisticated social engineering campaigns propagated directly through social media platforms, most notably Facebook, MySpace, and Twitter.<br><br><b>Understanding Koobface</b><br>To an infected user, the compromise began with a message from a 'friend' on Facebook containing a link to a sensational video. For a threat intelligence analyst, Koobface represented a paradigm shift in botnet architecture. It utilized a decentralized, peer-to-peer (P2P) C2 structure long before it was common, and its entire propagation mechanism relied on hijacking the user's browser session to automatically send malicious links to all of the victim's social media contacts, creating a massive, self-sustaining viral loop.<br><br><b>Execution and Social Engineering Mechanics</b><br>The infection started when a user clicked the link in the social media message (`T1566.002`). They were directed to a fake YouTube page that claimed they needed an 'Adobe Flash Player Update' to view the video (`T1204.002`). This 'update' was the Koobface dropper. Upon execution, Koobface dropped multiple components. It modified the Windows `hosts` file (`T1562.001`) to redirect search engines (Google, Yahoo) to attacker-controlled pages for click-fraud monetization. Crucially, it injected a module into the web browser (`T1185`). When the user next logged into Facebook, Koobface intercepted the session cookie (`T1539`). It then silently used the victim's account to generate and send new malicious messages to all their friends, continuing the cycle (`T1534`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive click-fraud generation (costing advertisers millions) and the distribution of secondary malware like rogue antivirus (scareware). Detection was often initiated by victims realizing their accounts were sending spam. EDR would flag the unauthorized modification of the `%SystemRoot%\\System32\\drivers\\etc\\hosts` file. Network logs would show the botnet communicating over custom HTTP protocols on non-standard ports (like port 8090) to update its C2 peer list.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1539",
    "T1562.001",
    "T1566.002",
    "T1534"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Social Media)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Propagating via victim's account)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie",
      "tactic": "Credential Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses (Hosts File Modification)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to stop the malware from further hijacking the browser session and propagating spam.",
    "Instruct the user to immediately revoke all active sessions on their social media accounts and change their passwords from a known-clean device.",
    "Restore the Windows `hosts` file to its default state to stop the click-fraud search redirections.",
    "Deploy an enterprise anti-malware solution to remove the heavily obfuscated Koobface components (often hidden deep in the user's AppData directory)."
  ],
  "what_to_avoid": [
    "Do not assume the user intentionally sent the spam messages; Koobface entirely automates the process using stolen session cookies.",
    "Avoid relying solely on static file signatures, as the Koobface operators constantly updated and repacked the binary to evade detection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}