Induc

Overview

Virus:Win32/Induc is a highly unique, fascinating, and historic file infector from 2009 that introduced a terrifying new vector for supply chain attacks. Instead of infecting random executable files, Induc specifically targeted software developers by infecting the **Delphi programming compiler** (versions 4 through 7). Once a developer's machine was infected, every single new, legitimate software program they compiled would automatically contain the Induc virus, turning innocent software vendors into unwitting malware distributors.

Understanding the Induc Virus
To an end-user, an Induc-infected file behaved perfectly normally, as the virus was largely benign and contained no destructive payload. For security analysts and software developers, Induc was a nightmare. It proved that trust in digitally signed, legitimate software could be fundamentally broken if the compiler itself was compromised. Countless legitimate applications worldwide were suddenly flagged as malware because their developers were infected with Induc.

Execution and Compiler Infection Mechanics
The infection began when a developer accidentally ran an executable that had been compiled on an already-infected machine (`T1204.002`). The virus would immediately search the registry for installations of Borland Delphi (`T1012`). If found, it navigated to the Delphi source folder and located a core library file named `SysConst.pas` (the source code for system constants). The virus injected its own malicious Delphi source code directly into `SysConst.pas` (`T1195`). It then invoked the Delphi command-line compiler to compile this modified file into a new `SysConst.dcu` (compiled unit). From that moment on, anytime the developer compiled *any* project, the Delphi linker would automatically include the malicious `SysConst.dcu`. Every output `.exe` became a carrier for the virus.

Indicators of Compromise & Impact
The primary impact was massive reputational damage to software vendors and a stark lesson in supply chain vulnerability. The IoC is the presence of the Induc signature within newly compiled Delphi executables. On the developer's machine, the key IoC is a modified `SysConst.pas` file containing malicious source code, and a recently compiled `SysConst.dcu` file in the Delphi library directory.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_INDUC {
    meta:
        description = "Detects Induc (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "induc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Induc Activity
id: 0bbd37750f4918899d9960732f2f86d8
status: experimental
description: Detects generic indicators of the induc malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*induc*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. For end-users: Simply delete the infected executable; the virus does not actively harm the system or steal data.
2. For Developers: Immediately stop distributing all software compiled on the infected machine.
3. Developers must navigate to their Delphi `Lib` directory, delete the maliciously compiled `SysConst.dcu`, and replace the `SysConst.pas` file with a clean backup from the installation media.
4. Developers must completely recompile all software projects from clean source code to ensure the resulting binaries are free of the virus.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the software vendor intentionally distributed malware; they were likely victims of the compiler infection.
2. Avoid simply cleaning the output `.exe`; the developer's environment remains compromised and will continue to generate infected files.

References & External Analysis

• Search "induc" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Regcure
• Tasker
• Bruteforce
• Qaccel
• Mumawow

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/induc.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.