Brambul

Overview

Worm:Win32/Brambul is a network-spreading worm attributed to the Lazarus Group (North Korean state-sponsored threat actors). Brambul is designed to spread laterally across local networks and the broader internet by actively brute-forcing Server Message Block (SMB) credentials on exposed ports (`T1110.001`). It is often used as a noisy precursor or a distraction technique during more targeted attacks.

Understanding Brambul (SMB Brute-Forcer)
To an end-user, a Brambul infection might manifest as network sluggishness or unexpected account lockouts. For a network defender, Brambul is a highly visible, aggressive threat. It highlights poor network segmentation and the presence of weak or default administrative credentials. Because it constantly scans and attacks, it is easily detected by intrusion detection systems (IDS).

Execution and Spreading Mechanics
Once Brambul executes on a compromised host, it establishes persistence via the Windows Registry (`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`). Its primary function then activates: it generates random IP addresses and attempts to connect to them via SMB (TCP port 445). If port 445 is open, the worm attempts to authenticate using a hardcoded list of common usernames and weak passwords (`T1110.001`). If successful, it copies itself to the target machine (`T1105`) and uses a scheduled task or a remote execution tool to launch the copy, continuing the cycle (`T1570`). It also emails system information back to attacker-controlled accounts.

Indicators of Compromise & Impact
The impact is rapid, uncontrolled lateral movement and potential exposure of the network to follow-on Lazarus Group payloads. Network IoCs are glaring: a massive spike in outbound SMB traffic (TCP 445) to random external IP addresses and internal subnets. Host-based IoCs include EDR alerts for thousands of failed login attempts (`Event ID 4625`) originating from a single machine, followed by successful logins across the network using default credentials.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BRAMBUL {
    meta:
        description = "Detects Brambul (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "brambul" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Brambul Activity
id: 34845238b3dcd8f9272c249d8afcda4d
status: experimental
description: Detects generic indicators of the brambul malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*brambul*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate any machine generating massive amounts of outbound SMB traffic (TCP 445) to prevent further lateral movement.
2. Implement firewall rules to strictly block outbound SMB (TCP 445) traffic from endpoints to the internet.
3. Identify the compromised credentials used by the worm and force a global password reset for those accounts.
4. Hunt across the network for the Brambul executable and its associated persistence registry keys, removing them enterprise-wide.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow SMB (TCP 445) to be accessible from the internet under any circumstances.
2. Avoid relying on default or easily guessable local administrator passwords, which are the primary vector for this worm.

References & External Analysis

• Search "brambul" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Clipspy
• Monitortool
• Ytddownloader
• Freenew
• Wisesystemmechanic

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/brambul.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.