{
  "family": "vobfus",
  "sample_count": 1484,
  "category": "worm",
  "description": "Vobfus (also known as Beebone) is a Windows worm. As documented by Malpedia (Fraunhofer FKIE), it searches for computers on a network and creates copies of itself in folders with open access; for the malware to activate, a user must first run it on the computer. Vobfus is written in the Visual Basic programming language and uses code obfuscation, which is a distinguishing feature of the family. This obfuscation complicates attempts by anti-virus software to analyze the malware. The Beebone botnet associated with Vobfus was the subject of a coordinated takedown.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "win32.vobfus",
    "vobfus.a",
    "vobfus.b",
    "worm.vobfus",
    "bfus"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Vobfus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Vobfus, also known as Beebone, is a Windows worm. According to Malpedia, it spreads by searching for computers on a network and copying itself into folders with open access, allowing it to propagate to other machines and drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Vobfus spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Per Malpedia, Vobfus searches for computers on a network and creates copies of itself in folders with open access. For the malware to be activated, a user must first run the copied file on the computer, so it relies on a user executing the dropped copy."
      }
    },
    {
      "@type": "Question",
      "name": "What makes Vobfus hard to detect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malpedia notes that Vobfus is written in Visual Basic and uses code obfuscation, which is a distinguishing feature of the family. This obfuscation is designed to complicate attempts by anti-virus software to analyze the malware."
      }
    },
    {
      "@type": "Question",
      "name": "What is the connection between Vobfus and Beebone?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Beebone is another name for the Vobfus family. The Beebone botnet built on this malware was the subject of a coordinated takedown effort, as referenced in the Malpedia entry's cited reporting."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1091",
    "T1036.005",
    "T1105",
    "T1547.001",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-10",
  "sources": [
    {
      "name": "Malpedia (Fraunhofer FKIE): Vobfus (win.vobfus)",
      "url": "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus"
    }
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}