{
  "family": "peed",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nPeed (also widely known as the Storm Worm or Peacomm) was one of the most prolific and sophisticated botnets of the late 2000s. Originally appearing disguised as breaking news regarding a storm in Europe, Peed evolved into a massive, decentralized, peer-to-peer (P2P) botnet utilized by cybercriminals for massive spam distribution, Distributed Denial of Service (DDoS) attacks, and identity theft.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nThe primary infection vector for Peed is massive spam email campaigns. The emails use high-pressure, topical social engineering (news events, fake e-cards, or invoice notifications) to trick the user into opening a malicious attachment or clicking a link to a drive-by download site.\n\nOnce executed, Peed demonstrates advanced, highly resilient architecture:\n<ul>\n<li><strong>Peer-to-Peer (P2P) C2 Infrastructure:</strong> Unlike traditional botnets that relied on a central C2 server (which could be easily taken down by law enforcement), Peed utilizes a decentralized P2P protocol (often Overnet). Infected machines communicate directly with each other to receive commands and updates, making the botnet incredibly difficult to dismantle.</li>\n<li><strong>Aggressive Rootkit Evasion:</strong> Peed employs aggressive rootkit techniques (often utilizing `wincom32.sys`) to hide its files, registry keys, and active network connections from the user and traditional antivirus software. It actively attempts to disable local security services.</li>\n<li><strong>Monetization (Spam and DDoS):</strong> The primary function of an infected node is to silently send massive volumes of spam (often pump-and-dump stock scams or pharmaceutical ads) or to participate in coordinated DDoS attacks against specific targets for extortion.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile the original Storm Worm botnet has largely been mitigated, the P2P and fast-flux DNS techniques it pioneered are still heavily utilized by modern malware. A Peed-style infection indicates a total compromise of the endpoint and places significant legal and reputational risk on the organization due to the machine's participation in global spam and DDoS operations.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Network Containment:</strong> Immediately isolate the infected machine from the network. Because the botnet relies on P2P communications, blocking standard P2P ports and monitoring for high volumes of outbound SMTP (Port 25) traffic is critical.</li>\n<li><strong>Rootkit Removal (Bare-Metal Restore):</strong> Because Peed utilizes kernel-level rootkits, manual removal is highly unreliable. The only secure remediation is to completely format the hard drive and reinstall the operating system from a trusted image.</li>\n<li><strong>Spam Blacklist Monitoring:</strong> If an infected machine successfully sent out spam, the organization's public IP address may be added to global DNS-based Blackhole Lists (DNSBLs), disrupting legitimate corporate email delivery.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.Peacomm",
    "Worm.Storm",
    "Win32/Peed"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1090.002",
    "T1014",
    "T1498",
    "T1568"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:25:49Z",
  "type": "Trojan / P2P Botnet",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}