{
  "family": "palevo",
  "sample_count": 106,
  "category": "advanced_threat",
  "description": "Worm:Win32/Palevo (widely known as the Butterfly Bot or Mariposa botnet) is a highly prolific, modular botnet agent and worm historically responsible for massive DDoS attacks, widespread credential theft, and the aggressive distribution of secondary malware payloads.<br><br><b>Understanding Palevo (Butterfly Bot)</b><br>To the end-user, a Palevo infection might result in a slightly sluggish PC or the sudden hijacking of their social media accounts. For incident responders, it is a severe, multi-faceted threat. Operating at its peak in the late 2000s and early 2010s, the Mariposa botnet (built on the Palevo malware) infected millions of machines globally. It is designed to be highly modular, allowing its operators to dynamically update its capabilities, launch massive UDP/TCP floods, or harvest credentials on an industrial scale.<br><br><b>Execution and Evasion Strategies</b><br>Palevo primarily propagates via social engineering on messaging platforms (MSN Messenger, Skype) by sending malicious links to the victim's contacts, via infected USB drives (exploiting the Windows AutoRun feature), or through P2P file-sharing networks. Upon execution, it injects its core payload into legitimate processes (like <code>explorer.exe</code> or <code>svchost.exe</code>) to evade detection. It establishes a covert connection to a C2 server (often using UDP for resilience) to receive commands. Crucially, Palevo employs API hooking to steal passwords from a massive list of applications (browsers, FTP clients, gaming platforms) and intercepts DNS requests.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total endpoint compromise and participation in global cybercrime. Threat hunters should look for anomalous outbound UDP traffic originating from injected system processes. The presence of hidden files on USB drives and unexpected modifications to the Windows HOSTS file are classic Palevo IoCs. EDR platforms frequently flag Palevo for its aggressive API hooking and process injection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1055",
    "T1498",
    "T1091",
    "T1056.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint to sever the connection to the C2 server, halting DDoS participation and data exfiltration.",
    "Force a global password reset for all user accounts, as Palevo systematically harvests credentials from all installed applications.",
    "Capture a full memory image to extract the injected Palevo payload and identify the specific C2 infrastructure it was communicating with.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as Palevo frequently downloads other severe malware families."
  ],
  "what_to_avoid": [
    "Do not insert any USB drives into the infected machine during triage; Palevo will immediately infect the drive to spread laterally.",
    "Avoid relying solely on manual file deletion; the injected processes will instantly recreate the persistence mechanisms."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}