{
  "family": "loveletter",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nLoveletter (infamously known as the \"ILOVEYOU\" bug) is a historic, highly destructive mass-mailing worm that caused catastrophic global disruption in May 2000. While largely eradicated from modern environments, it serves as a foundational case study in social engineering and the abuse of native Windows scripting environments. The worm leveraged Microsoft Outlook and a VBScript payload to rapidly self-propagate while simultaneously overwriting and destroying millions of critical user files.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLoveletter's unprecedented spread was fueled by a perfectly executed social engineering lure:\n<ul>\n<li><strong>The \"LOVE-LETTER-FOR-YOU.TXT.vbs\" Lure:</strong> The worm arrived via email with the subject line \"ILOVEYOU.\" It contained an attachment masquerading as a text file but was actually a malicious Visual Basic Script (.vbs). At the time, default Windows settings hid file extensions, leading users to believe it was a harmless text document.</li>\n<li><strong>Mass-Mailing Propagation:</strong> Upon execution, the VBScript utilized Windows Scripting Host (WSH) to interact with the Microsoft Outlook MAPI interface. It automatically sent a copy of itself to every single contact in the victim's Windows Address Book, causing exponential network congestion and email server crashes worldwide.</li>\n<li><strong>Destructive Payload (File Overwriting):</strong> Beyond spreading, Loveletter was highly destructive. It recursively scanned local and mapped network drives, searching for files with extensions like `.jpg`, `.jpeg`, `.vbs`, `.vbe`, `.js`, `.css`, `.mp3`, and `.mp2`. It overwrote these files with a copy of its own malicious code and appended `.vbs` to the filename, effectively destroying the original data.</li>\n<li><strong>Password Theft (Barok Trojan):</strong> In some variants, the script also attempted to download and execute a secondary payload known as the \"Barok\" trojan, designed to steal cached RAS (Remote Access Service) passwords.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Loveletter worm is obsolete due to modern email filtering and macro security policies, the *techniques* it pioneered are still actively used today. File-overwriting is the precursor to modern ransomware, and utilizing native scripting languages (VBS, PowerShell) to \"live off the land\" remains a primary tactic for advanced threat actors.\n\n<h3>Historical Remediation</h3>\n<ul>\n<li><strong>Mail Gateway Blocking:</strong> The immediate response involved configuring corporate firewalls and email gateways to outright block incoming emails containing the subject line \"ILOVEYOU\" or attachments ending in `.vbs`.</li>\n<li><strong>Disable Windows Scripting Host:</strong> Many organizations temporarily disabled the Windows Scripting Host (`wscript.exe`) entirely via Group Policy to prevent the payload from executing, a tactic still utilized during severe \"fileless\" malware outbreaks today.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "VBS/LoveLetter",
    "Worm.ILoveYou",
    "VBS.LoveBug"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1059.005",
    "T1485",
    "T1114.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:11:36Z",
  "type": "Worm",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}