{
  "family": "mydoom",
  "sample_count": 88,
  "category": "backdoor",
  "description": "Worm:Win32/Mydoom (also known as Novarg or Shimgapi) is a historically devastating, incredibly fast-spreading mass-mailing worm and backdoor that caused massive global internet slowdowns, email server outages, and orchestrated massive DDoS attacks in 2004.<br><br><b>Understanding Mydoom</b><br>To the end-user in 2004, Mydoom manifested as an inbox flooded with bounce messages or deceptive emails carrying malicious attachments. For IT administrators, Mydoom was a nightmare of bandwidth exhaustion; at its peak, it was estimated that 1 in every 12 emails sent globally was a Mydoom variant. It is considered one of the fastest-spreading worms in history. Its primary objectives were rapid propagation via email and P2P networks (Kazaa), establishing a backdoor on infected hosts (TCP port 3127), and launching a coordinated DDoS attack against SCO Group and Microsoft.<br><br><b>Execution and Evasion Strategies</b><br>Mydoom spread primarily via email. The user received an email with a deceptive subject line (e.g., 'Error', 'Mail Transaction Failed') and an executable attachment disguised as a text file or ZIP archive. Upon execution, the worm copies itself to the Windows System directory and establishes persistence via Registry Run keys. It aggressively scans the hard drive to harvest email addresses. Using its own built-in SMTP engine, it blasts out thousands of copies of itself. Crucially, it opens a backdoor (listening on TCP ports 3127-3198), allowing the attacker to remotely execute arbitrary code, which was frequently used to drop secondary malware.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive email server congestion and endpoint compromise (via the backdoor). Incident responders will observe a massive spike in outbound traffic on TCP port 25 (SMTP). A definitive Mydoom IoC is an unauthorized process listening on TCP port 3127. The presence of a file named `shimgapi.dll` in the System32 directory is a classic indicator.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1036.004",
    "T1114.001",
    "T1547.001",
    "T1498",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and sever the active backdoor listening on TCP 3127.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Utilize EDR or network scanners to identify any hosts with open, listening ports in the 3127-3198 range.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as the backdoor was frequently used to install additional rootkits and malware."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; the open backdoor provides full remote command execution to any attacker.",
    "Avoid assuming the threat is contained just by stopping the spam; ensure the initial vector is purged from all mailboxes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}