{
  "family": "cycbot",
  "sample_count": 8,
  "category": "ransomware",
  "description": "Backdoor:Win32/Cycbot is a notorious, highly persistent botnet agent and backdoor primarily known for executing massive click-fraud campaigns and hijacking search engine results. Initially discovered around 2010, Cycbot infects endpoints to forcefully route the victim's web traffic through attacker-controlled proxies, generating illicit revenue by simulating clicks on paid advertisements and acting as a conduit for secondary malware.<br><br><b>Understanding the Cycbot Botnet</b><br>To an end-user, a Cycbot infection manifests as severe browser instability, dramatically slowed internet speeds, and the constant redirection of their Google or Bing searches to irrelevant, ad-heavy websites. For a security analyst, Cycbot represents a severe compromise of network integrity. The malware effectively Man-in-the-Middles (MitM) the endpoint's web traffic, exposing the organization to data interception and acting as a persistent backdoor that the botmaster can use to deploy ransomware later.<br><br><b>Execution and Interception Mechanics</b><br>Cycbot is typically distributed via exploit kits or bundled with rogue software. Upon execution, it injects itself deeply into the `explorer.exe` process (`T1055`) to evade detection and establish a footprint. It ensures persistence by creating complex, randomly named Registry Run keys (`T1547.001`). The core functionality involves acting as a local proxy (`T1090`). Cycbot modifies the Windows network settings and hooks browser APIs (`T1185`) to intercept all HTTP/HTTPS traffic. When a user searches for a term, Cycbot queries its Command and Control (C2) server (`T1071.001`), which replies with a list of monetized URLs. Cycbot then seamlessly redirects the user's browser to these URLs, simulating legitimate ad clicks (`T1111`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, massive generation of fraudulent web traffic, and the potential for credential interception. Incident responders will observe anomalous outbound network traffic on standard web ports connecting to known Cycbot C2 infrastructure. Host-based IoCs include EDR alerts for process injection into `explorer.exe` and unauthorized modifications to the system's local proxy settings (e.g., altering the `ProxyServer` registry key).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055",
    "T1185",
    "T1111",
    "T1090"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into explorer.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Intercepting search queries)",
      "tactic": "Collection"
    },
    {
      "id": "T1090",
      "name": "Proxy (Acting as a local proxy to route traffic)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception (Potentially intercepting secure traffic)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the botnet proxy can be used to intercept sensitive corporate data or download secondary payloads.",
    "Use EDR to locate the injected thread within `explorer.exe` and terminate it, then remove the randomized Registry persistence keys.",
    "Manually audit and reset the Windows local proxy settings (`inetcpl.cpl` -> LAN settings) to ensure traffic is no longer being routed through the malware.",
    "Block all identified Cycbot C2 domains and IP addresses at the enterprise firewall."
  ],
  "what_to_avoid": [
    "Do not assume the infection is 'just adware'; Cycbot is a full-featured backdoor capable of executing arbitrary commands from the botmaster.",
    "Avoid ignoring the network anomalies; the click-fraud traffic consumes significant bandwidth and degrades network performance."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}