{
  "family": "mupx",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nMupx is a malicious threat that combines the persistence and self-replication capabilities of a network worm with the payload delivery mechanisms of a Trojan. It is designed to rapidly spread across local networks and removable media, establishing a wide footprint before opening a backdoor or downloading secondary payloads, making it a significant threat to enterprise environments lacking strict network segmentation.\n\n<h3>Propagation and Execution Lifecycle</h3>\nMupx utilizes a multi-pronged approach to maximize its infection radius within an organization.\n\nIts execution lifecycle relies on exploiting network trust and legacy Windows features:\n<ul>\n<li><strong>Removable Media Propagation:</strong> Mupx actively monitors the system for newly inserted USB flash drives. When a drive is detected, the worm copies itself to the root directory and creates a malicious `AutoRun.inf` file (or exploits `.lnk` shortcut vulnerabilities) to ensure it executes automatically when the drive is inserted into a new machine.</li>\n<li><strong>Network Share Exploitation:</strong> The worm aggressively scans the local network (LAN) for open Server Message Block (SMB) network shares. If it finds shares with weak or default credentials, it copies its executable to those drives, waiting for unsuspecting users to execute the file.</li>\n<li><strong>Payload Delivery (Trojan Functionality):</strong> Once Mupx successfully infects a new host, it typically modifies the Windows Registry (e.g., the `Run` key) to establish persistence. It then connects to a command-and-control (C2) server to receive further instructions, which frequently involves downloading and executing secondary malware, such as info-stealers or botnet agents.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Mupx infection is highly disruptive. Because of its worm capabilities, a single infected endpoint (or a single compromised USB drive) can lead to the rapid infection of hundreds of machines across the enterprise. While the initial payload may just be a downloader, the ability of the C2 server to deploy secondary malware elevates this to a critical risk.\n\n<h3>Eradication and Incident Response</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Do not just isolate the initially infected machine. Physically or logically segment the affected VLAN to halt the lateral spread of the worm via open SMB shares.</li>\n<li><strong>Disable AutoRun/AutoPlay:</strong> Enforce strict Group Policy Objects (GPOs) that entirely disable AutoRun and AutoPlay functionality across all drives in the enterprise to prevent the USB propagation vector.</li>\n<li><strong>Enterprise-Wide Sweeps:</strong> Conduct a massive forensic sweep across all endpoints and network shares to identify the Mupx executable and remove its persistence mechanisms. Scrutinize network logs for unauthorized outbound connections indicating C2 communication.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Worm.Mupx",
    "Trojan.Mupx",
    "W32/Mupx.Worm"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1547.001",
    "T1059",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:02:47Z",
  "type": "Trojan / Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}