{
  "family": "mofksys",
  "sample_count": 14,
  "category": "worm",
  "description": "Worm:Win32/Mofksys is a malicious computer worm designed to spread rapidly across networks, via removable USB drives, and through malicious email attachments. Targeting Microsoft Windows systems, Mofksys acts as both a self-propagating threat and a backdoor for attackers.<br><br><b>Understanding Mofksys</b><br>Unlike simple viruses, worms like Mofksys are designed to move laterally without user intervention once initial access is gained on a network. Mofksys is often used as a precursor to more severe attacks, as it establishes a foothold that can be leveraged to drop secondary payloads.<br><br><b>Execution and Propagation</b><br>Upon execution, Mofksys immediately attempts to establish persistence by modifying Windows registry Run keys (`T1547.001`), ensuring it starts automatically when the system boots. It then begins scanning the local network for vulnerable shares (`T1021.002`) and copies itself to any connected removable media (`T1091`). Mofksys frequently exhibits data theft capabilities, collecting sensitive system information and user credentials, which it transmits to an attacker-controlled server via SMTP or HTTP (`T1048`). Furthermore, it opens a backdoor on the infected system, allowing remote attackers to execute arbitrary commands, log keystrokes, and download additional, more destructive payloads.<br><br><b>Indicators of Compromise (IoCs)</b><br>Defenders should look for unexpected outbound SMTP or HTTP traffic originating from anomalous processes. The creation of unauthorized executable files on network shares or removable drives is a strong indicator of worm activity. Look for suspicious registry modifications in `HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run` designed to execute unknown binaries.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm:Win32/Mofksys",
    "Virus:Win32/Mofksys",
    "Worm:Win32/Mofksys.A",
    "Virus:Win32/Mofksys.B"
  ],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1091",
    "T1021.002",
    "T1048",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-10",
  "mitre_attack_detail": [
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactic": "Exfiltration"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the infected machine from the local network and internet immediately to halt the worm's lateral movement and data exfiltration.",
    "Disable AutoRun/AutoPlay across the organization to prevent the worm from executing via infected USB drives.",
    "Perform a full system scan with an updated enterprise antivirus solution, booting into Safe Mode if necessary to bypass active rootkits.",
    "Change all user credentials and administrative passwords that were stored or used on the infected system, as they may have been compromised."
  ],
  "what_to_avoid": [
    "Do not connect any USB drives or external storage to the infected system until it has been completely sanitized.",
    "Do not assume only one machine is infected; worms spread rapidly, so you must sweep the entire network for IoCs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}