{
  "family": "unruy",
  "sample_count": 1267,
  "category": "click_fraud",
  "description": "Trojan:Win32/Unruy is an intrusive malware family specializing in click fraud, adware bundling, and the forced installation of Potentially Unwanted Applications (PUAs) to generate illicit revenue.<br><br><b>What is Unruy?</b><br>For the victim, Unruy drastically degrades system performance, causes browsers to crash, and constantly opens hidden browser windows. For threat analysts, Unruy is a monetization engine. It operates silently in the background, utilizing hidden browser instances (often headless Internet Explorer or Chrome instances) to navigate to specific advertisements and artificially simulate user clicks, generating pay-per-click revenue for the attacker.<br><br><b>Infection Vectors & Threat Hunting</b><br>Unruy is typically distributed through deceptive download links on torrent sites, fake software updates (e.g., 'Flash Player Update'), or bundled with pirated software. Once executed, it drops its components into the <code>%AppData%</code> or <code>%ProgramData%</code> directories. It establishes persistence via the registry Run keys. Threat hunters should look for instances of <code>iexplore.exe</code> running in the background without any visible windows, consuming massive amounts of CPU and RAM.<br><br><b>Forensic Analysis & Impact</b><br>The primary impact is the theft of computing resources and the potential exposure to secondary malware, as Unruy often updates itself or downloads additional adware modules from its C2 servers. Incident responders should analyze proxy logs for high volumes of automated HTTP traffic directed at known advertising networks. EDR alerts for 'Suspicious Headless Browser Execution' or 'Excessive Network Connections from Hidden Process' are classic indicators of an Unruy infection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1564.003",
    "T1189",
    "T1547.001",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1564.003",
      "name": "Hide Artifacts: Hidden Window",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to halt the click-fraud traffic and prevent the downloading of additional adware modules.",
    "Terminate any hidden, high-CPU browser processes (like <code>iexplore.exe</code> or <code>chrome.exe</code>) running in the background.",
    "Audit the Windows Registry Run keys and Startup folder to identify and remove the Unruy persistence mechanisms.",
    "Perform a full system scan with a reputable anti-malware solution to eradicate the dropped executables in <code>%AppData%</code>."
  ],
  "what_to_avoid": [
    "Do not allow the user to continue using the machine; the constant background click-fraud significantly impacts performance and battery life.",
    "Avoid relying solely on manual file deletion; Unruy often uses watchdog processes to restore deleted files if the registry keys aren't removed first."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}