{
  "family": "ircfast",
  "sample_count": 2,
  "category": "trojan",
  "description": "Worm/Trojan:Win32/Ircfast is a network worm and botnet agent that leverages the Internet Relay Chat (IRC) protocol for command and control. Prevalent during the peak era of IRC-based botnets, Ircfast is designed to compromise a system, self-propagate across network shares, and connect the infected host to an attacker-controlled chat channel to receive commands, typically for participating in Distributed Denial of Service (DDoS) attacks.<br><br><b>Understanding Ircfast (IRC Botnets)</b><br>To an end-user, an Ircfast infection might cause general system sluggishness and network latency. For a security team, it represents a noisy, highly disruptive infection. Unlike modern botnets that use Tor or encrypted HTTPS, IRC botnets are 'loud' (`T1071.001`), transmitting commands in cleartext over well-known ports, making them easier to detect but very difficult to eradicate once they gain a foothold in a flat network.<br><br><b>Execution and Propagation Mechanics</b><br>Ircfast spreads primarily by scanning the local subnet for open Windows administrative shares (IPC$, C$, ADMIN$) and attempting brute-force password guessing (`T1110.001`). Once it successfully copies itself (`T1105`) and executes on a new machine, it establishes persistence via the Registry Run keys. The malware then initiates a connection to a hardcoded IRC server (often on port 6667), joins a specific hidden channel, and waits for commands from the botmaster. These commands can instruct the bot to download additional malware, execute a UDP/TCP flood attack (`T1498`), or aggressively scan for new targets (`T1046`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is network congestion, participation in illegal DDoS activities, and potential data theft. Network IoCs are highly prominent: persistent outbound TCP connections to external IP addresses on port 6667 (or alternative IRC ports like 6660-6669), and massive spikes in outbound scanning traffic (TCP 135/445) as the worm attempts to spread. Host IoCs include unknown executables running from the Windows System32 directory and corresponding Registry persistence entries.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1046",
    "T1071.001",
    "T1498",
    "T1110.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (Using IRC for Command and Control)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing (Brute-forcing network shares to spread)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Executing DDoS commands on behalf of the botmaster)",
      "tactic": "Impact"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Aggressively scanning the local subnet for vulnerable hosts)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately segment the infected VLANs to prevent the worm from traversing the entire enterprise network.",
    "Block outbound IRC traffic (TCP port 6667 and related ports) at the perimeter firewall to sever the command and control link.",
    "Enforce strong password policies across all service accounts and local administrator accounts to defeat the worm's brute-forcing mechanism.",
    "Use enterprise EDR to hunt for the specific Ircfast executables and Registry Run keys across all endpoints simultaneously."
  ],
  "what_to_avoid": [
    "Do not attempt to clean individual machines without first isolating the network, as the worm will immediately re-infect them via administrative shares.",
    "Avoid ignoring outbound traffic to unfamiliar ports, as IRC botnets frequently shift their C2 to non-standard high ports to evade simple firewall rules."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}