Threat Actor: Kelihos Botnet Syndicate
Kelihos Botnet Syndicate is classified as an advanced Historical Threat Group originating primarily from Russia (Peter Yuryevich Levashov / Severa). Driven by operational objectives spanning mass cryptocurrency stealing, stock pump-and-dump malspam & fast-flux proxy rentals, this threat entity has maintained an active footprint from 2010 - 2017 (DOJ Extradition & Conviction). In enterprise telemetry and malware repository classification, Kelihos Botnet Syndicate has been corroborated across 2 distinct malware families with over 48 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | Severa Network, Hlux Botnet Operators |
|---|---|
| Targeted Sectors | Enterprise Email Servers, Stock Market Investors, Retail Consumers |
| Primary Motivations | Mass Cryptocurrency Stealing, Stock Pump-and-Dump Malspam & Fast-Flux Proxy Rentals |
| Dominant Payload Categories | Spam Bot · Botnet |
| MITRE ATT&CK Reference | https://attack.mitre.org/software/S0055/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Kelihos Botnet Syndicate:
T1566.002— weaponized across 2 catalog payload(s)T1071.001— weaponized across 2 catalog payload(s)T1560.001— weaponized across 2 catalog payload(s)T1059.003— weaponized across 2 catalog payload(s)T1114.001— weaponized across 1 catalog payload(s)T1005— weaponized across 1 catalog payload(s)T1568.001— weaponized across 1 catalog payload(s)T1498— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Kelihos Botnet Syndicate has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2006-4704 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2007-0038 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2010-1885 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2012-0158 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (2 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Kelihos Botnet Syndicate:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| storm | Botnet | 1 | Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infe... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding Kelihos Botnet Syndicate operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Kelihos Botnet Syndicate requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).