{
  "family": "klez",
  "sample_count": 8,
  "category": "advanced_threat",
  "description": "Worm:Win32/Klez is a historic, highly destructive mass-mailing worm that first appeared in late 2001 and raged across the internet for years. Klez fundamentally changed the landscape of malware by being one of the first major worms to utilize **'Sender Spoofing'**. By forging the 'From:' address in its emails, it caused massive confusion, resulting in innocent users being accused of spreading the virus, and making the true source of the infection incredibly difficult to track down.<br><br><b>Understanding the Klez Worm</b><br>To an infected user, the computer might slow down, and their antivirus software would suddenly stop working. To the rest of the world, it appeared as if everyone was emailing the virus to everyone else. For security analysts, Klez represents the peak of the mass-mailing worm era. It was highly aggressive, exploiting an unpatched vulnerability in Microsoft Outlook/Internet Explorer that allowed the malicious attachment to execute *automatically* just by viewing the email in the preview pane.<br><br><b>Propagation and Spoofing Mechanics</b><br>The infection cycle begins when a victim receives a seemingly legitimate email containing the Klez executable. It exploited the `IFRAME` vulnerability (CVE-2001-0154) (`T1190`) to execute without user interaction (`T1204`). Upon execution, Klez drops itself into the Windows System folder and establishes persistence (`T1547.001`). Its core function is propagation (`T1534`). It scans the victim's hard drive for email addresses (in address books, cached web pages, and documents). When sending a copy of itself, Klez randomly selects an address from the victim's address book to place in the 'To:' field, and crucially, selects *another* random address to place in the 'From:' field (Sender Spoofing). Furthermore, Klez actively attempts to disable and delete dozens of popular antivirus programs to ensure its survival (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive network congestion, reputational damage due to spoofing, and the disabling of endpoint security. The most glaring IoC is an overwhelming surge in outbound SMTP traffic on port 25 originating from the endpoint. Host-based IoCs include EDR alerts for the sudden, forceful termination of antivirus processes and the creation of randomly named executables in the `%SystemRoot%`.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1190",
    "T1547.001",
    "T1534",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing (Mass-mailing propagation)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application (Exploiting Outlook IFRAME vulnerability)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network immediately to halt the mass-mailing engine and stop the outbound flood of infected emails.",
    "Block outbound SMTP (Port 25) traffic at the enterprise firewall for all workstations, ensuring only authorized mail servers can send email.",
    "Ensure the endpoint's antivirus is actually running, as Klez explicitly targets and disables security software.",
    "Deploy the MS01-020 (or cumulative) patch for Internet Explorer to prevent the automatic execution vulnerability."
  ],
  "what_to_avoid": [
    "Do not trust the 'From:' address of a Klez-infected email; the person listed there is almost certainly innocent and likely not the source of the infection.",
    "Avoid assuming the threat is modern; Klez relies on early 2000s exploits, so an infection indicates severely outdated software."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}