{
  "family": "zeroaccess",
  "sample_count": 28,
  "category": "trojan",
  "description": "Trojan:Win32/ZeroAccess (also known as Sirefef or max++) was one of the largest and most sophisticated botnets in history. At its peak, it infected millions of machines globally, utilizing a devastatingly effective combination of a kernel-mode rootkit for stealth and a decentralized Peer-to-Peer (P2P) architecture for unstoppable Command and Control (C2). Its primary monetization methods were massive click fraud and Bitcoin mining.<br><br><b>Understanding ZeroAccess</b><br>To the victim, a ZeroAccess infection was often silent, save for increased CPU usage (from mining) or a slow internet connection. For security analysts, ZeroAccess was a nightmare. It did not rely on centralized C2 servers that law enforcement could seize. Instead, every infected node communicated with other nodes in a massive P2P swarm. Furthermore, its rootkit components buried the malware so deeply in the operating system that standard antivirus could not see the files or registry keys.<br><br><b>Execution, Rootkits, and P2P Architecture</b><br>ZeroAccess was distributed via exploit kits (like Blackhole) and affiliate pay-per-install networks (`T1189`). Upon execution, the installer immediately deployed a complex kernel-mode rootkit (`T1014`). It hijacked the `afd.sys` driver or overwrote critical system files to load its driver at boot. The rootkit hooked SSDT (System Service Descriptor Table) APIs to hide its files, folders, and network connections. For C2, ZeroAccess used a custom P2P protocol over UDP (`T1090.001`). Infected nodes would exchange lists of other peers, ensuring the botnet could always receive new payloads (like updated click-fraud modules or miners) even if major portions of the network were taken offline.<br><br><b>Indicators of Compromise & Impact</b><br>The impact was total system compromise and massive bandwidth consumption. Because the rootkit hid the files, traditional disk scans were useless. Network analysts had to look for the distinctive UDP P2P traffic. EDR platforms were required to detect the kernel-level API hooking. If ZeroAccess was detected, the only truly safe remediation was a complete wipe and reinstall of the operating system.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1090.001",
    "T1496",
    "T1055",
    "T1014"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1090.001",
      "name": "Proxy: Internal Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever its connection to the ZeroAccess P2P swarm and halt click fraud/mining activities.",
    "Due to the advanced kernel-mode rootkit, live analysis is highly unreliable. Capture a memory dump for forensic analysis if necessary.",
    "Do not attempt manual removal; the rootkit actively defends its files and registry keys, and attempting to delete them can cause a Blue Screen of Death (BSOD).",
    "Perform a bare-metal wipe and complete reinstallation of the Windows Operating System. This is the only guaranteed way to eradicate the rootkit."
  ],
  "what_to_avoid": [
    "Do not trust the output of standard administrative tools (Task Manager, Regedit, Explorer) on a ZeroAccess infected machine; the rootkit lies to them.",
    "Avoid relying on standard AV scans for remediation; they will often fail to see or remove the rootkit drivers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}