{
  "family": "wabot",
  "sample_count": 1185,
  "category": "rat",
  "description": "Trojan:Win32/Wabot is a malicious botnet component and trojan designed to compromise Windows systems and recruit them into a larger controlled network. It is characterized by its ability to receive dynamic commands from a remote server, allowing operators to repurpose the infected hosts for various malicious activities, such as launching Distributed Denial of Service (DDoS) attacks, distributing spam, or downloading additional credential-stealing modules. Wabot typically achieves persistence by copying itself to hidden system directories and modifying the Windows Registry. It often communicates over standard web protocols (HTTP/HTTPS) or IRC to blend its command-and-control traffic with legitimate network activity.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "high",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1071.001",
    "T1498",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint to prevent it from participating in DDoS attacks or spam campaigns.",
    "Analyze network traffic to identify the C2 infrastructure and implement network-level blocks.",
    "Scan the system for persistence mechanisms in the registry and remove dropped executable files in hidden folders.",
    "Reset any compromised credentials if Wabot managed to download and deploy keylogging modules."
  ],
  "what_to_avoid": [
    "Do not leave the endpoint connected to the network during triage, as it may actively harm external targets or internal bandwidth."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}