{
  "family": "slenfbot",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Worm:Win32/Slenfbot is a highly infectious network worm and botnet agent notorious for its aggressive self-propagation methods. Once executed on a host, it immediately attempts to replicate itself across the local network and to any connected removable media (USB drives), while simultaneously connecting the infected machine to a central IRC-based Command and Control (C2) botnet for further instructions, such as launching DDoS attacks or downloading additional malware.<br><br><b>Understanding Slenfbot (USB Worms/Botnets)</b><br>To an end-user, the infection might be unnoticeable until their network connection slows to a crawl due to DDoS activity or aggressive scanning. For a security administrator, a Slenfbot outbreak is a severe incident that can rapidly paralyze a corporate network. It exploits the human tendency to share files via USB (`T1091`) and weak network share permissions (`T1021.002`).<br><br><b>Execution and Propagation Mechanics</b><br>Slenfbot is most commonly introduced into an environment via an infected USB drive. It relies on the Windows `autorun.inf` feature (or tricks the user into clicking a disguised executable) to launch (`T1204.002`). Upon execution, it copies itself to the Windows system folder and establishes persistence via the Registry Run keys. Crucially, it immediately begins polling for new USB drives; when one is inserted, it silently copies itself and a malicious `autorun.inf` to the drive. Simultaneously, it connects to an IRC server (`T1071.002`) to join the botnet, awaiting commands from the botmaster.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is rapid, widespread infection and potential involvement in coordinated botnet attacks. Host-based IoCs include the presence of malicious `.exe` or `.vbs` files and hidden `autorun.inf` files on the root directory of all attached USB drives. EDR will detect the creation of autostart registry keys pointing to executables in the `System32` directory. Network IoCs are highly visible: unauthorized IRC traffic (often TCP ports 6667-6669) connecting to unknown domains, and massive internal network scanning (SMB/Port 445) as the worm attempts lateral movement.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1091",
    "T1071.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB spreading)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1071.002",
      "name": "Application Layer Protocol: File Transfer Protocols (IRC C2 communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution (Registry persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately disable the 'Autorun' and 'Autoplay' features across the entire enterprise via Group Policy to halt USB-based propagation.",
    "Isolate infected machines from the network to prevent them from participating in botnet activities (like DDoS) or spreading laterally via SMB.",
    "Block known IRC ports (6667-6669) at the perimeter firewall to sever the C2 connection for all infected bots.",
    "Mandate a physical sweep and format of all unapproved USB flash drives used within the organization."
  ],
  "what_to_avoid": [
    "Do not insert a suspected infected USB drive into an unprotected machine for analysis without disabling Autorun first.",
    "Avoid assuming a single cleaned machine means the incident is over; worms propagate rapidly, and other infected machines will simply re-infect it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}