Dorkbot

Overview

Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected over one million endpoints across 190 countries between 2011 and its international coordinated disruption by the FBI, Microsoft, DHS CISA, and international law enforcement. Formally documented under CISA Technical Alert TA15-337A, Dorkbot leverages aggressive social-engineering propagation over Skype, Windows Live Messenger, Facebook Chat, Twitter, and removable USB drives weaponizing shortcut (.LNK) vulnerabilities. Once established, Dorkbot connects via encrypted IRC or HTTP protocols to cybercriminal command-and-control servers, enabling adversaries to execute arbitrary commands, harvest banking credentials and FTP logins through web browser form grabbing, conduct high-volume Distributed Denial of Service (DDoS) SYN and UDP floods, and deploy secondary malware loaders including ransomware and cryptocurrency miners.

Known aliases

Threat reports may refer to this family under multiple names:

• Worm:Win32/Dorkbot
• NgrBot
• Backdoor.Win32.NgrBot
• W32/Dorkbot.worm
• Trojan.Dorkbot

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Irc Botnet Frameworks

Known Derivatives & Downstream Variants: Ngrbot · Dorkbot.A · Dorkbot.B · Dorkbot.D

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2010-2568 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2012-0158 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 34c8d5d4d38c6422557e4e89bb90f92420dbad754ff36691795c32ab5d496e62
• 8a74e50eb19875e5330e70be315c1e956bc5594119fa9d13db1b8f4f3ca4d2e8

Delivery vectors

• Instant messaging spam (Skype, Windows Live Messenger) containing shortened malicious hyperlinks
• Removable USB drives weaponizing CVE-2010-2568 Windows Shell LNK shortcut execution
• Malicious email attachments exploiting CVE-2012-0158 Microsoft Office memory corruption

Persistence mechanisms

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to hidden binary in %APPDATA%
• Autorun.inf and hidden .lnk shortcuts created on root directories of connected removable drives

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_DORKBOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Dorkbot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "dorkbot" ascii wide nocase
        $s2 = "worm:win32/dorkbot" ascii wide nocase
        $s3 = "ngrbot" ascii wide nocase
        $s4 = "backdoor.win32.ngrbot" ascii wide nocase
        $s5 = "w32/dorkbot.worm" ascii wide nocase
        $s6 = "trojan.dorkbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Dorkbot (Botnet) Execution & Triage
id: 3834b61b-21c6-564f-82ec-a7e5281a8fa5
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Dorkbot malware family. Detects firewall rule subversion, internal port
  proxying, and command-and-control keepalive polling indicative of botnet nodes.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/dorkbot
- https://malware-families-catalog.systemhelpdesk.com/defensive/botnet-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.botnet
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1091
- attack.t1185
- attack.t1071_001
- attack.t1056_001
- attack.t1498
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \netsh.exe
    - \route.exe
    - \arp.exe
    - \ping.exe
    CommandLine|contains:
    - advfirewall firewall add rule
    - netsh interface portproxy
    - ping -n 1 127.0.0.1
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_DORKBOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Dorkbot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "dorkbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate compromised hosts from corporate networks to block active IRC/HTTP command channel communications.
2. Disable Windows Autorun/Autoplay and enforce strict application whitelisting on removable USB storage media.
3. Reset all user enterprise credentials, financial portal passwords, and FTP authentication tokens from clean endpoints.
4. Deploy endpoint detection signatures to purge Dorkbot registry persistence and memory-injected thread artifacts.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not insert untrusted USB drives into administrative or management workstations without air-gapped forensic inspection.
2. Avoid navigating to links received through instant messaging or social media without out-of-band sender verification.

References & External Analysis

• CISA Alert TA15-337A: Dorkbot Botnet Technical Analysis
• Microsoft Defender Threat Encyclopedia - Worm:Win32/Dorkbot
• NIST National Vulnerability Database - CVE-2010-2568
• CISA Advisory: TA15-337A
• Search "dorkbot" on VirusTotal (External Analysis)
• Search "dorkbot" on Any.Run (Sandbox Sandbox)
• Search "dorkbot" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: TA15-337A ↗

Frequently Asked Questions

Related Threats (Category: Botnet)

Explore other documented threats in the same operational category:

• Stantinko
• Simda
• Glupteba
• Palevo
• Phorpiex
• Cybernetic
• Tordev
• Storm

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/dorkbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.