{
  "family": "komodia",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamous for being the underlying technology behind the **'Superfish'** adware scandal, where it was discovered pre-installed on Lenovo laptops in 2015. While marketed to parental control and ad-injection companies as a way to monitor encrypted web traffic, its implementation acts exactly like a malicious rootkit and fundamentally breaks the security model of the internet on infected endpoints.<br><br><b>Understanding the Komodia (Superfish) Threat</b><br>To an end-user, Komodia is invisible, though they might notice unexpected advertisements appearing on secure websites like Google or their bank. For a security analyst, Komodia is a catastrophic vulnerability. To intercept encrypted HTTPS traffic, Komodia installs a self-signed root certificate authority (CA) into the Windows certificate store and acts as a local Man-in-the-Middle (MitM) proxy. The fatal flaw was that all installations of Komodia shared the *exact same private key* for this root certificate.<br><br><b>Execution and TLS Interception Mechanics</b><br>Komodia is typically bundled with adware (like Superfish) or aggressive parental control software (`T1189`). Upon execution, it installs a local proxy service (`T1543.003`) and reroutes all endpoint web traffic through it (`T1562.004`). Crucially, it forces the installation of its own root CA into the Trusted Root Certification Authorities store (`T1553.004`). When a user visits a secure site (like `https://bank.com`), the Komodia proxy intercepts the connection, decrypts the traffic (`T1185`), injects ads or logs the data, and then re-encrypts the connection to the browser using a dynamically generated certificate signed by its fake root CA. Because the private key was hardcoded and easily extracted, *any* attacker on the same network (e.g., a public Wi-Fi hotspot) could use that key to completely spoof any secure website, bypassing all browser security warnings.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete destruction of endpoint TLS security and the exposure of all passwords, banking details, and secure communications. The primary IoC is the presence of unauthorized root certificates in the Windows Certificate Manager (`certmgr.msc`) (specifically looking for 'Superfish, Inc.' or 'Komodia'). Network analysts will observe all HTTPS traffic originating from the endpoint being proxied through `localhost` before exiting the network.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1553.004",
    "T1562.004",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1553.004",
      "name": "Subvert Trust Controls: Install Root Certificate (Breaking TLS)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Rerouting traffic to local proxy)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Middle interception)",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (The local proxy engine)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Identify and completely uninstall the software utilizing the Komodia SDK (e.g., Superfish, KeepMyFamilySecure, Kurupira).",
    "CRITICAL: Uninstalling the software does NOT remove the root certificate. You must manually open `certmgr.msc` and delete the compromised root CA from the 'Trusted Root Certification Authorities' store.",
    "Run Microsoft's dedicated Malicious Software Removal Tool (MSRT) or an enterprise EDR solution specifically configured to hunt and strip Komodia certificates.",
    "Enforce a mandatory password reset for all accounts the user accessed while the software was active, as all HTTPS traffic was decrypted."
  ],
  "what_to_avoid": [
    "Do not assume uninstalling the parent adware fixes the vulnerability; the rogue root certificate remains and can be exploited by any attacker.",
    "Avoid ignoring the alert; even if the software was installed 'legitimately' for parental controls, the shared private key makes the endpoint highly vulnerable to interception."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}