{
  "family": "wapomi",
  "sample_count": 5191,
  "category": "worm_banker",
  "description": "Wapomi is a polymorphic file-infecting worm that spreads through removable drives, network shares, and infected executables. It downloads additional payloads, including information stealers and adware, and modifies system files to maintain persistence. Wapomi is commonly seen in large outbreaks across organizations with weak USB controls and unpatched systems.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "pioneer",
    "viking"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Wapomi?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wapomi is a polymorphic file-infecting worm that spreads through removable drives, network shares, and infected executables. It downloads additional payloads, including information stealers and adware, and modifies system files to maintain persistence. Wapomi is commonly seen in large outbreaks across organizations with weak USB controls and unpatched systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Wapomi spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Wapomi (Viking) is a file-infecting worm spreading through network shares, removable media, and infected executables."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of a Wapomi infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Modified executables across the system, network share scanning traffic, and AV detections for Wapomi, Pioneer, or Viking are diagnostic."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Wapomi on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [
    "T1091",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}