{
  "family": "tdss",
  "sample_count": 35,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/TDSS (universally known as Alureon or the TDL-4 botnet) is a legendary, incredibly sophisticated family of kernel-mode rootkits and botnet architectures that ravaged Windows systems from 2008 to 2012. TDSS is famous for its extreme technical complexity, specifically its ability to infect the Master Boot Record (MBR) and bypass 64-bit Windows kernel patch protection (PatchGuard).<br><br><b>Understanding TDSS / Alureon</b><br>To the victim, TDSS was completely invisible. Its primary purpose was to silently corral the machine into a massive botnet used for click fraud, DNS hijacking, and spam distribution. For security researchers, TDSS (specifically version TDL-4) was considered one of the most advanced pieces of malware ever engineered. It operated entirely in Ring-0 (kernel mode), meaning it had higher privileges than the antivirus software trying to detect it.<br><br><b>Execution and Extreme Evasion (MBR Infection)</b><br>TDSS was typically distributed via drive-by downloads or as a secondary payload. Its defining characteristic was its persistence mechanism (`T1542.003`). TDL-4 would physically overwrite the computer's Master Boot Record (MBR). When the computer was turned on, the TDSS code executed *before* the Windows operating system even began to load. This allowed the rootkit to patch the OS kernel in memory on the fly, disabling digital signature checks and PatchGuard (`T1014`). Once running, TDSS created a hidden, encrypted Virtual File System (VFS) in unallocated disk space to store its configuration and plugins, rendering them completely invisible to standard forensic tools (`T1564.005`).<br><br><b>Indicators of Compromise & Historical Impact</b><br>TDSS hijacked DNS requests (`T1568.002`) and intercepted all network traffic at the NDIS layer, altering search results to generate affiliate revenue. Because it operated below the OS, standard AV scanners could not see the infected MBR or the hidden VFS. Detection required specialized offline MBR scanners or deep memory forensics. In 2012, a major FBI operation (Operation Ghost Click) successfully took down the core TDSS C2 infrastructure, effectively neutralizing the botnet, though legacy infections persisted for years.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1542.003",
    "T1112",
    "T1564.005",
    "T1014",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Bootkits",
      "tactic": "Persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564.005",
      "name": "Hide Artifacts: Hidden File System",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Because TDSS is an MBR bootkit, standard remediation is impossible while the OS is running. The machine must be powered off immediately.",
    "Boot the system using an offline, trusted live CD (e.g., a Linux forensic environment or specialized Rescue Disk).",
    "Use specialized tools (like `bootrec.exe /fixmbr`) from the recovery environment to physically overwrite and repair the Master Boot Record.",
    "Given the depth of the kernel compromise, a complete wipe and reinstall of the operating system is highly recommended."
  ],
  "what_to_avoid": [
    "Do not trust the results of any anti-virus scan run while the infected operating system is active; TDSS hooks the APIs to hide itself.",
    "Avoid relying solely on file deletion; the rootkit lives in the MBR and a hidden partition, not just in standard Windows directories."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}