{
  "family": "netsky",
  "sample_count": 105,
  "category": "advanced_threat",
  "description": "Worm:Win32/Netsky is a historically devastating, highly prolific mass-mailing worm that caused massive global network congestion and email server outages by aggressively self-replicating and harvesting email addresses from infected machines.<br><br><b>Understanding Netsky</b><br>To the end-user in the mid-2000s, Netsky manifested as an inbox flooded with deceptive emails carrying malicious attachments. For IT administrators, Netsky was a nightmare of bandwidth consumption and SMTP server overload. It was created by a teenager (Sven Jaschan, who also created Sasser) and became one of the most widespread worms in internet history. Its primary objective was pure propagation, utilizing a built-in SMTP engine to blast itself to every address it could find.<br><br><b>Execution and Evasion Strategies</b><br>Netsky spread almost exclusively via email. The user received an email with a deceptive subject line (e.g., 'Mail Transaction Failed', 'Read it immediately!') and an executable attachment disguised as a document (e.g., <code>document.pif</code>, <code>message.scr</code>). Upon execution, the worm copies itself to the Windows directory and establishes persistence via Registry Run keys. It then aggressively scans the entire hard drive (specifically targeting <code>.txt</code>, <code>.html</code>, and <code>.eml</code> files) to harvest email addresses. Using its own built-in SMTP engine, it crafts thousands of new emails, attaches itself, and sends them out, spoofing the 'From' address to sow confusion.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive email server congestion, bandwidth exhaustion, and reputational damage. Incident responders will observe a massive, continuous spike in outbound traffic on TCP port 25 (SMTP) originating from unexpected processes on the endpoint. EDR platforms frequently detect Netsky based on 'Suspicious SMTP Activity'. The presence of a randomly named executable in the Windows directory constantly reading document files is a classic Netsky IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1114.001",
    "T1566.001",
    "T1498",
    "T1036.004",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and prevent the corporate IP from being blacklisted by spam filters.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Utilize EDR to identify and terminate the specific process running the Netsky SMTP engine.",
    "Perform a full system sweep to locate and remove the core Netsky executable and its associated Run keys."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; being blacklisted will cause all legitimate corporate emails to be blocked globally.",
    "Avoid assuming the threat is contained just by stopping the spam; ensure the initial vector (the malicious email attachment) is purged from all inboxes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}