{
  "family": "vjworm",
  "sample_count": 2,
  "category": "backdoor",
  "description": "Worm:VBS/Vjworm (and its variants like JS/Vjworm) is a highly aggressive, self-propagating worm written in scripting languages (Visual Basic Script or JavaScript). Its defining characteristic is its heavy reliance on Removable Media (USB drives) for propagation (`T1091`), making it a significant threat to air-gapped or poorly segmented operational technology (OT) environments.<br><br><b>Understanding VJWorm</b><br>To an end-user, an infection often starts when they plug in an infected USB drive; their legitimate files appear to have vanished, replaced by 'shortcuts' that look like their folders. For a security team, VJWorm is a highly visible, persistent nuisance that indicates a failure in USB device control policies. While primarily a worm, it also functions as a backdoor, allowing the attacker to download additional payloads or steal data.<br><br><b>Execution and Propagation Mechanics</b><br>VJWorm is distributed initially via malicious downloads or spam, but its primary vector is lateral movement via USB. When a clean USB drive is inserted into an infected machine, VJWorm copies its heavily obfuscated script file (often `.vbs`, `.js`, or `.wsf`) to the drive. Crucially, it then hides all legitimate files and folders on the USB drive (`T1564.001`) and creates Windows Shortcut (`.lnk`) files (`T1566.001`) with the same names as the hidden folders. When a user on a *new* machine clicks the shortcut to open their 'folder', the shortcut actually executes the VJWorm script via `wscript.exe`, infects the new host, and *then* opens the legitimate folder to avoid suspicion. It establishes persistence on the host via the Registry Run keys.<br><br><b>Indicators of Compromise & Impact</b><br>The impact ranges from significant operational disruption (network congestion, hidden files) to data exfiltration via the backdoor capability. Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from suspicious locations (like the root of a USB drive or `%AppData%`), and the presence of suspicious `.lnk` files on removable media. Network IoCs include the script reaching out to dynamic DNS domains for C2 instructions.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1564.001",
    "T1547.001",
    "T1059.005",
    "T1091"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media (The core propagation mechanism via USB)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (Execution of the payload via wscript)",
      "tactic": "Execution"
    },
    {
      "id": "T1564.001",
      "name": "Hide Artifacts: Hidden Files and Directories (Hiding the victim's legitimate files on the USB)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Host persistence)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately enforce USB port blocking (Device Control) across the enterprise to halt lateral propagation.",
    "Isolate infected machines to prevent the worm from reaching out to its C2 server or attempting network share propagation.",
    "Run a script to unhide all files (`attrib -h -s -r /s /d *.*`) and delete the malicious `.lnk` files and `.vbs`/`.js` payloads on affected drives.",
    "Review the Registry Run keys (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) for entries executing `wscript.exe`."
  ],
  "what_to_avoid": [
    "Do not simply delete the `.lnk` files on the USB drive; you must unhide the user's actual files to restore functionality.",
    "Avoid allowing Autoplay/Autorun for removable media, as this facilitates the automatic execution of some worm variants."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}