{
  "family": "storm",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "Worm:Win32/Storm (also known as the Storm Worm or Nuwar) is a historically significant, highly resilient botnet and worm that caused massive disruptions in the late 2000s. It is renowned for its pioneering use of a decentralized, peer-to-peer (P2P) Command and Control architecture (`T1090.002`) and highly successful, socially engineered email lures (often referencing current events or storms, hence the name).<br><br><b>Understanding Storm (P2P Botnets)</b><br>To an end-user, a Storm infection might slow down the network or cause their email account to be blacklisted. For security researchers, Storm represents a turning point in malware evolution. Instead of relying on a central C2 server (which could be easily taken down by law enforcement), infected nodes communicated with each other via the Overnet protocol, making the botnet incredibly difficult to dismantle.<br><br><b>Execution and Propagation Mechanics</b><br>Storm propagated primarily via massive spam campaigns (`T1566.001`). The emails contained malicious attachments (often disguised as video codecs or news articles). Upon execution, Storm installed a rootkit (`T1014`) to hide its files, processes, and network connections. It disabled local antivirus software (`T1562.001`) and immediately began utilizing the host to send thousands of new spam emails to propagate further (`T1498`). The botnet was also used to launch devastating Distributed Denial of Service (DDoS) attacks against security researchers investigating it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was massive bandwidth consumption and participation in global cybercrime. Host-based IoCs were notoriously difficult to spot due to the rootkit, requiring offline forensic analysis. Network IoCs were highly distinct: infected hosts generated massive volumes of outbound SMTP traffic (Spam) and communicated via UDP on ports associated with the Overnet P2P protocol.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1498",
    "T1014",
    "T1090.002",
    "T1566.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.002",
      "name": "Proxy: External Proxy (Using P2P architecture for decentralized C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1014",
      "name": "Rootkit (Hiding the malware's presence from the OS and AV)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service (Using the botnet for DDoS attacks)",
      "tactic": "Impact"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary propagation vector)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the infected machine from the network immediately to stop it from sending spam and participating in the P2P network.",
    "Due to the presence of a kernel-mode rootkit, the only guaranteed remediation is to completely wipe the hard drive and reinstall the operating system from a clean image.",
    "Analyze firewall logs to identify internal IP addresses generating excessive outbound SMTP or UDP traffic, indicating other infected nodes.",
    "Ensure enterprise spam filters are updated to catch the latest social engineering lures used by the botnet."
  ],
  "what_to_avoid": [
    "Do not trust the output of standard task managers or antivirus scans on a running, infected system, as the rootkit actively hides the malware.",
    "Avoid allowing endpoints to communicate directly via SMTP (port 25) outbound; all email should route through a designated, filtered mail gateway."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}