{
  "family": "rustock",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/Rustock (also known as Costrat) is one of the most historically significant and technically advanced malware families ever created. Operating from 2006 until its takedown in 2011, it was the engine behind the infamous Rustock botnet, which at its peak comprised over a million infected PCs and generated a staggering 30 billion spam emails per day. It achieved this massive scale through its use of a highly sophisticated, kernel-mode rootkit to remain completely invisible to security software.<br><br><b>Understanding Rustock (Kernel Rootkits)</b><br>To an end-user, a Rustock infection was entirely invisible; the PC continued to function normally, aside from consuming massive network bandwidth in the background. For security researchers, Rustock was a nightmare. By installing itself as a kernel driver (`T1014`), Rustock operated at a higher privilege level (Ring 0) than the antivirus software designed to detect it, allowing the malware to lie to the operating system about its existence.<br><br><b>Execution and Evasion Mechanics</b><br>Rustock was primarily distributed via spam emails and drive-by downloads (`T1189`). Upon execution, the dropper exploits an OS vulnerability to bypass Driver Signature Enforcement and install its malicious `.sys` driver into the kernel. Once active, Rustock uses advanced API hooking (specifically SSDT hooking) to intercept calls from the OS. If an AV scanner asks to list all running processes, Rustock intercepts the request and removes itself from the list before the OS replies. It then silently communicates with its C2 servers (using custom encryption and RC4) to receive spam templates and target lists (`T1071.001`), utilizing a custom, hidden SMTP engine to blast out pharmaceutical and stock fraud spam (`T1498.002`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact was the covert enslavement of the endpoint for massive spam distribution. Because of the kernel rootkit, traditional host-based IoCs (like finding the file on disk or seeing the process in Task Manager) were useless while the OS was running. Detection required specialized offline scanning (booting from a clean USB) or advanced memory forensics. Network IoCs were the primary detection vector: massive volumes of outbound SMTP traffic (Port 25) originating from a standard user workstation.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1014",
    "T1498.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Kernel-level evasion via SSDT hooking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498.002",
      "name": "Network Denial of Service: Reflection Amplification (Used here for massive spam distribution)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the infected endpoint from the network to immediately halt the massive outbound spam campaigns.",
    "Do NOT attempt to remove a kernel rootkit while the operating system is running; the rootkit controls the removal tools.",
    "The only guaranteed method for remediating a kernel-level rootkit infection like Rustock is a complete wipe and re-image of the hard drive.",
    "Ensure the enterprise network blocks outbound Port 25 (SMTP) traffic from all standard workstations, forcing traffic through a monitored mail gateway."
  ],
  "what_to_avoid": [
    "Do not trust the output of standard administrative tools (like Task Manager or `netstat`) on a machine suspected of a rootkit infection.",
    "Avoid relying solely on file-based antivirus to detect advanced rootkits; network behavioral analysis is critical."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}