{
  "family": "egroupdial",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Dialer:Win32/Egroupdial represents a legacy classification of malware that was highly prevalent during the era of dial-up internet modems. It is designed to commit financial fraud by silently disconnecting a user's modem from their standard Internet Service Provider (ISP) and reconnecting it to a premium-rate international or adult-service phone number, generating massive, unauthorized charges on the victim's phone bill.<br><br><b>Understanding Dialer Malware</b><br>To an end-user in the early 2000s, an Egroupdial infection was often unnoticeable until they received a phone bill for thousands of dollars in international calls. While modern broadband (cable/fiber) is entirely immune to dialers because they do not use phone lines to route traffic, Dialers remain a critical historical case study in automated financial extortion and telecommunications fraud.<br><br><b>Execution and Dialing Mechanics</b><br>Egroupdial was typically distributed via deceptive 'free access' links on adult websites or bundled with pirated software (`T1189`). Upon execution (`T1204.002`), the malware establishes persistence and immediately interfaces with the Windows Telephony Application Programming Interface (TAPI) (`T1562.001`). It suppresses the modem speaker volume so the user cannot hear the dialing tones (`T1562.001`). It then terminates the active dial-up connection and initiates a new PPP (Point-to-Point Protocol) connection to a hardcoded, premium-rate phone number controlled by the malware authors (`T1498`), keeping the connection open as long as possible to maximize revenue.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is direct, massive financial loss for the user via their telecommunications provider. Technical IoCs on legacy systems included the creation of new, unauthorized Dial-Up Networking (DUN) profiles in the Windows Network Connections panel. Behavioral IoCs included the modem spontaneously disconnecting and reconnecting, and the modem speaker being permanently muted.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1189",
    "T1498",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1498",
      "name": "Network Denial of Service (Legacy dialing fraud classification)",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Muting modem speakers to hide dialing)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "If analyzing a legacy system, physically unplug the phone line from the modem immediately to halt the fraudulent charges.",
    "Delete any unknown Dial-Up Networking (DUN) connection profiles found in the Network Connections control panel.",
    "Use standard antivirus to remove the Egroupdial executable and its persistence mechanisms.",
    "Contact the telecommunications provider to report the fraud and request a block on all international or premium-rate dialing from that landline."
  ],
  "what_to_avoid": [
    "Do not assume modern endpoints are vulnerable; this threat requires a physical analog modem connected to a landline to function.",
    "Avoid paying the phone bill without first disputing the charges as fraud with the telecommunications carrier."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}