{
  "family": "lovgate",
  "sample_count": 15,
  "category": "trojan",
  "description": "Worm:Win32/Lovgate is a historic, highly destructive mass-mailing worm and backdoor that caused massive disruption in the early 2000s. It combines the rapid, automated propagation techniques of a network worm with the persistent, remote-control capabilities of a Remote Access Trojan (RAT).<br><br><b>Understanding Lovgate</b><br>To an end-user, a Lovgate infection often presents as system sluggishness and complaints from contacts receiving strange emails from their account. For a security analyst, Lovgate represents a self-replicating network threat. Its primary goal is not just to infect the initial machine, but to use that machine as a launchpad to aggressively scan the local network and the internet for other vulnerable hosts, while simultaneously opening a backdoor for the attacker.<br><br><b>Execution, Propagation, and Backdoor Operations</b><br>Lovgate typically arrives via malicious email attachments (`T1566.001`), often masquerading as a love letter or a funny joke. Upon execution, it copies itself to the Windows System directory and establishes persistence via the Registry Run keys (`T1547.001`). Its defining characteristic is its aggressive propagation. It harvests email addresses from the victim's address book and local files, utilizing its own built-in SMTP engine to spam copies of itself to all contacts (`T1534`). Furthermore, it attempts lateral movement by aggressively scanning the local network for open IPC$ and ADMIN$ shares (`T1021.002`), attempting to authenticate using a hardcoded dictionary of common passwords. Once installed, it opens a backdoor on a specific TCP port (often 10168), allowing a remote attacker full administrative control over the infected machine (`T1105`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme network congestion, spam generation, and total endpoint compromise via the backdoor. Incident responders will observe massive spikes in outbound SMTP traffic (TCP port 25) and intense SMB scanning (TCP port 445/139) originating from the infected host. EDR logs will flag the unauthorized creation of system processes and modifications to the Registry Run keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1021.002",
    "T1105",
    "T1534",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the aggressive SMTP spamming and the local SMB scanning/lateral movement.",
    "Block the specific backdoor TCP port (e.g., 10168) at the enterprise firewall to sever the attacker's remote control capabilities.",
    "Audit all network shares (IPC$, ADMIN$) to ensure strong passwords are enforced, preventing the worm's dictionary attack propagation.",
    "Use an enterprise anti-malware tool to locate and remove the worm executable from the Windows System directory and strip the Registry Run keys."
  ],
  "what_to_avoid": [
    "Do not leave the machine on the network while attempting manual removal; the worm will continue to spam contacts and attack other internal hosts.",
    "Avoid relying on weak or default local administrator passwords, as these are the primary targets for Lovgate's network spreading module."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}