{
  "family": "security",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "Rogue:Win32/Security (often seen as SecurityShield, SecurityTool, etc.) is a broad categorization for 'Rogueware' or Fake Antivirus software. These applications use highly deceptive social engineering tactics to trick users into believing their computer is heavily infected with malware, then demand payment (via credit card) to 'clean' the non-existent threats (`T1189`).<br><br><b>Understanding Security (Rogueware / Fake AV)</b><br>To an end-user, the infection is terrifying: their screen is bombarded with flashing red warnings, fake system scans claiming hundreds of infections, and pop-ups blocking them from opening legitimate applications (like Task Manager). For an IT department, Rogueware is a significant disruption that paralyzes user productivity, though it rarely steals data in the background like a traditional RAT.<br><br><b>Execution and Extortion Mechanics</b><br>Rogueware is typically delivered via malvertising ('Drive-by Compromise') or bundled with other software. Once executed, it aggressively establishes persistence (`T1547.001`) and often modifies the Windows Registry (specifically `Image File Execution Options` or `IFEO`) to prevent the user from launching `taskmgr.exe`, `regedit.exe`, or real antivirus software (`T1562.001`). It then displays constant, uncloseable full-screen alerts demanding payment, effectively locking the user out of their machine until they pay the 'license fee'.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme user disruption and potential financial loss if the user pays the fake fee. Host-based IoCs include the presence of highly visible, fake security software UIs, modifications to the `IFEO` registry keys designed to block system utilities, and a barrage of fake system notifications. Network IoCs include connections to the payment gateways operated by the rogueware authors.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1189",
    "T1562.001",
    "T1491"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (The most common delivery method via fake 'You are infected' ads)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blocking Task Manager and real AV to prevent removal)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1491",
      "name": "Defacement (Taking over the desktop with fake security warnings)",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Reboot the infected machine into 'Safe Mode with Networking' to bypass the rogueware's persistence mechanisms and autorun blocks.",
    "Use a reputable, standalone anti-malware tool (like Malwarebytes) from Safe Mode to scan and remove the rogueware executables and registry keys.",
    "Reset browser settings if the rogueware altered the homepage or search engine.",
    "Educate the user on how to spot fake security alerts and warn them to monitor their credit card if they attempted to pay the 'fee'."
  ],
  "what_to_avoid": [
    "Do not allow the user to pay the 'license fee'; it will not unlock the computer and will compromise their credit card.",
    "Avoid trying to manually terminate the rogueware processes from the normal desktop, as it actively defends against Task Manager."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}