{
  "family": "iobit",
  "sample_count": 18,
  "category": "advanced_threat",
  "description": "PUA:Win32/IObit is a classification applied to various software products (such as Advanced SystemCare or Driver Booster) developed by IObit. While technically a legitimate software company, their products are frequently flagged as Potentially Unwanted Programs (PUAs) or Adware by major enterprise security vendors due to aggressive marketing tactics, bundled installations, and questionable system optimization claims.<br><br><b>Understanding the IObit Classification</b><br>To an end-user, an IObit product appears as a necessary tool to 'speed up' their PC or update their drivers. For a security analyst, these tools represent a significant risk surface. They often infiltrate enterprise environments via user downloads. Once installed, they perform deep, often unnecessary modifications to the Windows Registry and system services (`T1112`). They are flagged for displaying alarming, exaggerated scan results to coerce users into purchasing premium upgrades (Scareware tactics) and for occasionally bundling other third-party software during installation.<br><br><b>Execution and System Impact</b><br>IObit software requires administrative privileges to install. Upon execution, it establishes deep persistence via system services (`T1543.003`) and Scheduled Tasks to ensure it runs constantly in the background. The software actively monitors system performance and registry changes. While generally not maliciously exfiltrating data, the deep system hooks and driver modifications introduced by these 'optimizers' frequently cause system instability, blue screens (BSODs), and conflicts with legitimate enterprise EDR and antivirus agents.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is primarily system instability and wasted helpdesk resources resolving user-induced software conflicts. Incident responders will find IObit services running in `services.msc` and highly visible executables in `C:\\Program Files (x86)\\IObit`. Network logs may show frequent telemetry and update checks to IObit servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1189",
    "T1053.005",
    "T1112",
    "T1491"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Software)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1491",
      "name": "Defacement (Exaggerated UI Alerts)",
      "tactic": "Impact"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Utilize the Windows Control Panel or enterprise software management tools (like SCCM/Intune) to systematically uninstall all IObit products.",
    "Deploy an enterprise GPO (Group Policy Object) or AppLocker policy to explicitly block the execution of known IObit installation binaries.",
    "Audit the Windows Registry and Services to ensure that the uninstaller successfully removed all background monitoring services.",
    "Educate end-users on the dangers of third-party 'PC Optimizers' and strictly enforce least-privilege access to prevent unauthorized software installation."
  ],
  "what_to_avoid": [
    "Do not allow users to retain these tools under the belief that they improve performance; enterprise endpoints should be managed centrally, not by consumer 'optimizers'.",
    "Avoid ignoring the installation; if a user could install IObit (requiring Admin rights), they can install actual malware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}