{
  "family": "adylkuzz",
  "sample_count": 1,
  "category": "ransomware",
  "description": "Worm:Win32/Adylkuzz is a massive, stealthy cryptomining botnet that gained notoriety for exploiting the MS17-010 (EternalBlue) vulnerability (`T1210`) *before* the infamous WannaCry ransomware outbreak. While WannaCry caused global disruption by encrypting data, Adylkuzz operators preferred to stay hidden, quietly hijacking CPU resources (`T1496`) across tens of thousands of infected machines to mine Monero (XMR).<br><br><b>Understanding Adylkuzz (Resource Hijacking)</b><br>To an end-user, an Adylkuzz infection manifests as severe system sluggishness, high CPU utilization, and fan noise, as the malware consumes processing power. For an enterprise, it represents a massive theft of computing resources, increased power costs, and a critical vulnerability (SMBv1 exposure) that could have been exploited by far worse payloads.<br><br><b>Execution and Propagation Mechanics</b><br>Adylkuzz does not require user interaction. It operates as a worm (`T1090`), scanning the internet and local subnets for machines exposing vulnerable SMBv1 ports (445). It uses the EternalBlue exploit to gain SYSTEM-level access, then uses the DoublePulsar backdoor (`T1505.003`) to download and execute the cryptominer payload. Notably, once Adylkuzz infects a machine, it actively *closes* the SMB port to prevent other malware (like WannaCry) from infecting its host and competing for CPU resources (`T1562.004`), effectively 'patching' the machine for its own benefit.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource degradation and increased operational costs. Host-based IoCs include persistent CPU utilization nearing 100% by unknown or renamed processes (like `svchost.exe` or random strings), and the presence of DoublePulsar backdoor artifacts in memory. Network IoCs are distinct: constant outbound connections to Monero mining pools (often over port 4444 or 14444) and aggressive outbound SMB scanning on port 445 as the worm attempts to spread.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1210",
    "T1562.004",
    "T1505.003",
    "T1496"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (The core function of mining Monero cryptocurrency)",
      "tactic": "Impact"
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services (Using EternalBlue to spread laterally)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1505.003",
      "name": "Server Software Component: Web Shell / Backdoor (Using DoublePulsar to drop the miner)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Closing SMB ports to protect its host from competing malware)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately apply the MS17-010 patch to all Windows systems enterprise-wide; this is the primary propagation vector.",
    "Disable SMBv1 globally across the network, as it is obsolete and highly vulnerable.",
    "Isolate infected machines and terminate the heavily obfuscated mining processes.",
    "Block known cryptocurrency mining pool IP addresses and domains at the perimeter firewall to neutralize the financial incentive for the attackers."
  ],
  "what_to_avoid": [
    "Do not assume a machine is safe just because it didn't get hit by WannaCry; Adylkuzz quietly infected many of the exact same vulnerable hosts.",
    "Avoid relying solely on CPU monitoring; advanced miners can throttle their usage when a user is active to evade detection."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}