{
  "family": "taterf",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playing Games (MMORPGs) like World of Warcraft and Lineage. It gained massive notoriety for its aggressive propagation mechanisms, particularly its reliance on infecting removable USB drives and traversing open network shares.<br><br><b>Understanding Taterf (USB Worms)</b><br>To an end-user, a Taterf infection might go unnoticed until their valuable online gaming accounts are compromised and stripped of virtual assets. For a network administrator, Taterf is a severe nuisance that highlights poor network segregation and the dangers of unmanaged removable media. While its primary goal is gaming credential theft (`T1003`), its propagation methods cause significant 'background noise' and risk on corporate networks.<br><br><b>Execution and Propagation Mechanics</b><br>Taterf spreads aggressively via Lateral Movement. When an infected USB drive is inserted into a machine, Windows AutoRun (if enabled) automatically executes the worm (`T1091`). Once active, the worm copies itself to the Windows system folder and establishes persistence via the Registry Run keys (`T1547.001`). It then continually monitors for newly inserted USB drives, copying itself and a hidden `autorun.inf` file to them. Furthermore, it actively scans the local network for open SMB shares, attempting to copy its executable to any accessible network drives (`T1080`). To protect itself, Taterf attempts to terminate processes associated with popular antivirus and analysis tools (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is credential theft and network congestion. Host-based IoCs include the presence of `autorun.inf` files and hidden executables on the root of USB drives, and anomalous registry modifications ensuring startup. EDR solutions may flag the worm's attempts to forcefully terminate security processes. Network IoCs include excessive SMB traffic attempting to write executables to shared drives.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1080",
    "T1003",
    "T1091",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (USB Autorun)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1080",
      "name": "Taint Shared Content (Infecting network SMB shares)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Killing AV processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1003",
      "name": "OS Credential Dumping (Targeting game clients)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Globally disable the Windows AutoRun / AutoPlay feature via Group Policy to immediately halt the primary propagation vector.",
    "Restrict write access to root network shares and monitor for the creation of unauthorized executable files.",
    "Run a comprehensive AV scan across all endpoints and actively sanitize any inserted USB drives.",
    "Enforce strict network segmentation to limit the worm's ability to scan and infect adjacent subnets."
  ],
  "what_to_avoid": [
    "Do not simply delete the worm from a single endpoint without sanitizing associated USB drives; reinfection will occur immediately upon reinsertion.",
    "Avoid allowing unrestricted SMB file sharing across the entire enterprise, as this enables rapid worm propagation."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}