{
  "family": "vanbot",
  "sample_count": 3,
  "category": "trojan",
  "description": "Backdoor:Win32/Vanbot (derived from the Agobot/Spybot family) is a legacy trojan that infects a system and connects it to a clandestine Internet Relay Chat (IRC) server to receive commands from a botmaster. While IRC botnets are considered 'old-school' compared to modern HTTP/HTTPS C2 infrastructure, they remain highly effective for orchestrating massive Distributed Denial of Service (DDoS) attacks and network scanning.<br><br><b>Understanding Vanbot (IRC Botnets)</b><br>To an end-user, a Vanbot infection is typically invisible, unless the machine is actively participating in a DDoS attack, which would cause severe network sluggishness. For a security analyst, detecting IRC traffic (port 6667) originating from a standard user workstation—especially if the organization does not legitimately use IRC for communication—is an immediate, glaring indicator of compromise.<br><br><b>Execution and Command Mechanics</b><br>Vanbot is traditionally distributed via unpatched software vulnerabilities (particularly SMB and RPC exploits) or malicious email attachments (`T1189`). Upon execution, the malware establishes persistence via the Registry Run keys or as a Windows Service (`T1547.001`, `T1543.003`). The core of the backdoor is an embedded IRC client. It silently connects to a hardcoded IRC server and joins a specific, hidden channel (`T1071.002`). The botmaster issues commands directly into the chat channel. These commands typically include instructions to launch SYN floods against a target (`T1498`), download further modules (`T1105`), or aggressively scan the local subnet for vulnerable machines to propagate automatically like a worm (`T1046`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the enlistment of the host into a DDoS botnet and rapid lateral movement via automated exploitation. Host-based IoCs are standard registry or service persistence mechanisms. Network IoCs are the most obvious: persistent, unencrypted outbound TCP connections on port 6667 containing cleartext IRC protocol commands (`NICK`, `JOIN`) and massive outbound port scanning (e.g., TCP 135, 445).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1046",
    "T1543.003",
    "T1498",
    "T1071.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.002",
      "name": "Application Layer Protocol: File Transfer Protocol (and IRC)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Launching DDoS attacks via IRC commands)",
      "tactic": "Impact"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Worm-like scanning)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the IRC connection and stop the machine's participation in ongoing DDoS attacks and lateral scanning.",
    "Implement strict egress filtering at the corporate firewall to block outbound IRC traffic (TCP port 6667).",
    "Analyze network packet captures (PCAP) of the IRC traffic to identify the C2 server IP address, the IRC channel name, and potentially the commands being issued by the botmaster.",
    "Run a full anti-malware scan to remove the Vanbot executable and its service/registry persistence."
  ],
  "what_to_avoid": [
    "Do not assume that because IRC is an 'old' protocol, the malware is not dangerous; Vanbot variants are highly effective at worm-like propagation on unpatched internal networks.",
    "Avoid relying solely on port blocking (e.g., blocking 6667); bots can be configured to communicate over port 80 or 443."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}