{
  "family": "smbd",
  "sample_count": 5,
  "category": "advanced_threat",
  "description": "Worm:Win32/Smbd (or similar heuristic detections for SMB-exploiting worms) refers to a class of self-propagating malware that heavily relies on the Server Message Block (SMB) protocol for lateral movement across local area networks (LANs). These worms exploit vulnerabilities in Windows SMB implementations (historically MS08-067 or MS17-010/EternalBlue) or utilize brute-force credential stuffing against administrative shares to spread rapidly without user interaction.<br><br><b>Understanding SMB Network Worms</b><br>To an end-user, an infection might cause severe network slowdowns or sudden system reboots (often associated with successful SMB exploits). For a network administrator, an SMB worm represents a catastrophic outbreak scenario. A single infected laptop brought into the office can compromise the entire corporate network within minutes by scanning and exploiting vulnerable servers and workstations on the same subnet.<br><br><b>Execution and Lateral Movement Mechanics</b><br>Once an initial host is compromised (often via phishing or an external exploit), the Smbd worm begins its propagation phase. It actively scans the local subnet (`T1046`) on ports 139 and 445 (SMB) for other Windows machines. When it finds a target, it attempts to gain access. It may use hardcoded, highly privileged exploits (like EternalBlue) (`T1210`) to execute arbitrary code directly in the kernel of the remote machine. Alternatively, it may use stolen credentials or brute-force dictionaries to authenticate to the `ADMIN$` or `C$` hidden network shares (`T1021.002`). Upon successful connection, it copies its own executable to the remote machine (`T1570`) and uses tools like PsExec or WMI (`T1047`) to execute the copied payload, perpetuating the cycle.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total network compromise and massive internal bandwidth consumption. Host-based IoCs include EDR alerts for unexpected inbound connections on port 445 resulting in the creation of `.exe` files in `C:\\Windows\\` or `C:\\Windows\\System32\\`, followed by immediate execution. Network IoCs include massive spikes in horizontal (east-west) SMB traffic on ports 139/445, as infected machines aggressively scan their neighbors.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1210",
    "T1021.002",
    "T1046",
    "T1570"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services (e.g., EternalBlue on SMB)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer (Copying the worm to the remote host)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery (Scanning for port 445)",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Immediately segment the network at the switch/VLAN level to contain the horizontal spread of the worm.",
    "Enforce strict firewall rules blocking all workstation-to-workstation (east-west) SMB traffic (ports 139 and 445); workstations rarely need to share files directly with each other.",
    "Identify the vulnerable systems (missing critical Microsoft SMB patches) and immediately deploy the necessary updates.",
    "If credentials were used for propagation, force an immediate reset of all Domain Admin and local administrator passwords."
  ],
  "what_to_avoid": [
    "Do not allow unpatched, legacy operating systems (like Windows XP or Server 2003) to reside on the same network segments as critical infrastructure.",
    "Avoid leaving default local administrator accounts active with the same password across the enterprise, as worms exploit this for easy lateral movement."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}