{
  "family": "mailru",
  "sample_count": 174,
  "category": "pua",
  "description": "Adware:Win32/MailRu is an aggressive family of browser hijackers and Potentially Unwanted Programs (PUPs) originating from Russian software bundling networks.<br><br><b>What is MailRu?</b><br>For everyday users, a MailRu infection results in their browser homepage, new tab page, and default search engine being forcefully changed to Mail.ru or its affiliates. For cybersecurity professionals, MailRu represents a persistent compliance and security risk. It actively degrades the endpoint's security posture by intercepting web traffic, altering critical browser configurations, and acting as a beachhead for further adware installations.<br><br><b>Infection Vectors & Threat Hunting</b><br>MailRu is almost exclusively distributed via software bundlers. When a user downloads a freeware application from an untrusted source, the installer silently deploys the MailRu components. These components establish persistence by installing rogue browser extensions, modifying Windows shortcut (<code>.lnk</code>) files to append MailRu URLs to the browser executable path, and creating scheduled tasks to ensure the adware is reinstalled if the user attempts to remove it. <br><br><b>Forensic Analysis & Impact</b><br>The primary impact of MailRu is severe degradation of the user experience and a complete loss of data privacy, as search queries and browsing habits are tracked and monetized. Threat hunters will routinely flag MailRu through EDR alerts identifying unauthorized modifications to the <code>HKCU\\Software\\Policies\\Google\\Chrome</code> registry hives and the presence of suspicious scheduled tasks named similarly to 'MailRuUpdater'.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1189",
    "T1176",
    "T1112",
    "T1053.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Deploy specialized adware removal tools (such as AdwCleaner) to locate and eradicate MailRu's deep-rooted registry modifications.",
    "Manually inspect all desktop and taskbar shortcuts for web browsers, removing any appended MailRu URLs from the 'Target' field.",
    "Audit the Windows Task Scheduler and delete any tasks related to MailRu or unexpected software updaters.",
    "Reset all installed web browsers to their factory defaults to purge malicious extensions and hijacked search engine settings."
  ],
  "what_to_avoid": [
    "Do not allow end-users to download unvetted freeware or shareware, as this is the primary distribution mechanism for this adware.",
    "Avoid relying solely on the browser's built-in extension manager for removal, as MailRu often uses group policies to prevent extension deletion."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}