{
  "family": "daum",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware:Win32/Daum is a classification for Potentially Unwanted Programs (PUPs) and adware heavily associated with South Korean distribution networks (often leveraging the name of the legitimate Daum web portal). It is primarily designed to hijack browser settings, forcing the default search engine and homepage to specific affiliate sites, and injecting intrusive advertisements into the user's browsing sessions to generate fraudulent revenue (`T1189`).<br><br><b>Understanding Daum (Adware/Hijacker)</b><br>To an end-user, Daum is highly disruptive. They will find their preferred search engine (like Google) replaced, and every search query will be redirected through tracking domains. For an IT department, Daum adware represents a frustrating loss of productivity and a potential vector for more severe malvertising attacks, particularly if the endpoint frequently visits Korean web properties.<br><br><b>Execution and Hijacking Mechanics</b><br>Daum adware is typically bundled with freeware or deceptive game installers targeting Asian markets. Upon execution, it establishes persistence via Registry Run keys or Scheduled Tasks (`T1547.001`). It then aggressively modifies the browser configuration files and registry settings (e.g., `Start Page`, `Search Page`) for Internet Explorer, Chrome, and Edge (`T1562.001`). Advanced variants may drop malicious Browser Helper Objects (BHOs) or extensions that continuously monitor and inject ads into web traffic.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, loss of privacy, and potential exposure to further malware. Host-based IoCs include the presence of unexpected software in `%ProgramFiles%` (often with Korean language strings or metadata), unauthorized modifications to browser registry keys, and the forced installation of extensions. Network IoCs include web traffic constantly redirecting through specific tracking or affiliate URLs before reaching the intended destination.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.001",
    "T1562.001",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via deceptive software bundles)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Modifying browser registry settings to prevent removal)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys (Ensuring the adware starts at boot)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Use the standard Windows 'Programs and Features' applet to attempt uninstallation of the software.",
    "Follow up with a robust Adware/PUP removal tool (like AdwCleaner) to eliminate lingering registry hooks and scheduled tasks.",
    "Reset all installed web browsers to their factory defaults to completely clear out hijacked search settings and extensions.",
    "Educate users about the risks of software bundling, especially when downloading freeware from international aggregation sites."
  ],
  "what_to_avoid": [
    "Do not rely on simply changing the homepage back in the browser settings; the adware's persistence mechanism will change it back upon reboot.",
    "Avoid ignoring adware infections; the underlying affiliate networks they use are often compromised by threat actors."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}