{
  "family": "stormattack",
  "sample_count": 62,
  "category": "advanced_threat",
  "description": "Worm:Win32/Stormattack is a heuristic detection identifying components of the historically massive and devastating 'Storm Botnet' (or Storm Worm/Peacomm). Active primarily in the late 2000s, it pioneered the use of decentralized, peer-to-peer (P2P) botnet architectures to launch massive spam campaigns and crippling DDoS attacks.<br><br><b>Understanding the Storm Botnet</b><br>To the end-user in 2007, the Storm Worm arrived as an enticing email (famously, '230 dead as storm batters Europe', giving the malware its name). For security analysts, the Storm botnet represented a paradigm shift. Unlike earlier botnets that relied on a central, easily taken-down IRC server, Storm utilized a decentralized P2P architecture (Overnet). Millions of infected machines acted as individual nodes, sharing command instructions and files amongst themselves, making the botnet incredibly resilient to takedowns.<br><br><b>Execution and Evasion Strategies</b><br>Storm was distributed via massive email spam campaigns carrying malicious executables or links to exploit kits. Upon execution, the malware injected itself into `services.exe` to achieve system-level persistence and evasion (`T1055`). It immediately began communicating over UDP with other nodes in the P2P network to receive its instructions. The botnet was highly modular; the controllers could push updates to turn infected nodes into spam relays (sending pharmaceutical spam or more malware), proxies, or participants in massive, coordinated DDoS attacks against security researchers or rival cybercriminals. It also featured aggressive self-defense mechanisms, attacking systems that attempted to scan or probe it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was a hijacked endpoint contributing to global spam and DDoS infrastructure. Incident responders would observe massive amounts of encrypted UDP traffic (the P2P protocol) originating from `services.exe`. EDR platforms would flag the initial process injection. The presence of hidden rootkit components (often utilizing the `wincom32.sys` driver) was a classic indicator of a deep Storm infection.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1498",
    "T1055",
    "T1566.001",
    "T1090.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the massive outbound spam campaigns or its participation in a DDoS attack.",
    "Enforce strict egress firewall rules, particularly focusing on blocking the unauthorized UDP ports utilized by the P2P Overnet communication protocol.",
    "Capture a forensic memory image to analyze the injected threads within `services.exe` and identify the peer nodes it is communicating with.",
    "Assume total endpoint compromise; due to its aggressive rootkit components, a clean OS rebuild is the only guaranteed remediation."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'minor spam issue'; the botnet controllers have full remote code execution capabilities on the endpoint.",
    "Avoid relying solely on file deletion; the rootkit components actively hide files and registry keys from standard OS APIs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}