{
  "family": "opanki",
  "sample_count": 9,
  "category": "backdoor",
  "description": "Worm:Win32/Opanki is a legacy, self-propagating worm that gained extreme prevalence in the mid-to-late 2000s by aggressively exploiting Instant Messaging (IM) networks—specifically AOL Instant Messenger (AIM) and MSN Messenger. Its primary objective was rapid, viral propagation across social networks, turning infected endpoints into localized spam bots that bombarded the user's contact list with malicious links.<br><br><b>Understanding the Opanki Worm</b><br>To an infected user, the computer might seem fine, but their friends would suddenly report receiving strange, out-of-character messages from them containing suspicious links (e.g., 'haha look at this picture of us!'). For security analysts, Opanki was a nightmare of lateral movement via social engineering, utilizing the trust inherent in IM contact lists to achieve massive infection rates.<br><br><b>Propagation and IM Hijacking Mechanics</b><br>The infection cycle begins when a victim clicks a malicious link received from an infected friend via an IM client (`T1566.001`). The link downloads the Opanki executable (often disguised as a `.scr` screensaver or a `.pif` file). Upon execution (`T1204.002`), it establishes persistence via Registry Run keys (`T1547.001`). The worm then hooks into the active APIs of the running Instant Messaging clients (`T1056`). It scans the user's active contact list and automatically sends a hardcoded, socially engineered message containing a link to a copy of itself to every online contact (`T1534`). Some variants also contained backdoor functionality (`T1071.001`) or downloaded secondary adware payloads.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was severe disruption of communication networks, reputational damage to the user, and the potential deployment of secondary malware. The most glaring IoC is the user's IM client autonomously sending messages without user interaction. Host-based IoCs include EDR alerts for the creation of randomly named executables in the Windows System directory and the modification of Registry Run keys.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1547.001",
    "T1056",
    "T1534"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Propagating via IM contact lists)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Link",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1056",
      "name": "Input Capture (Hooking IM client APIs)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Instantly log the infected user out of all corporate and personal Instant Messaging platforms to halt the viral propagation of the worm.",
    "Isolate the endpoint from the network to prevent the worm from downloading any secondary payloads or updates from its C2 server.",
    "Use an enterprise antivirus solution to scan the Windows System directory and remove the Opanki executable and its associated registry hooks.",
    "Instruct the user to notify their contacts that their account was compromised and to ignore any recent links sent from their profile."
  ],
  "what_to_avoid": [
    "Do not assume the threat is modern; Opanki heavily targets obsolete IM protocols (AIM, MSN), meaning an infection on a modern system may be dormant or struggling to execute.",
    "Avoid ignoring the incident; while the worm itself is old, the vector (social engineering via trusted contacts) remains highly effective and may indicate a broader security awareness issue."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}