{
  "family": "brontok",
  "sample_count": 57,
  "category": "worm",
  "description": "Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing computer worm first surfacing in 2005 from Indonesian authors. Brontok propagates aggressively by scanning local drives for email addresses, utilizing an internal SMTP engine to blast infected messages with deceptive attachment names, and replicating to removable USB drives and shared network folders. Once resident, Brontok disables Windows Registry Editor (regedit), Task Manager, and Folder Options, and actively terminates system utility windows containing strings like 'regedit' or 'cmd', triggering immediate system reboots if users attempt diagnostics. The worm creates multiple startup entries across Windows Run keys, displays socio-political manifestos in browser windows, and launches ping-flood distributed denial-of-service attacks against designated websites.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Brontok",
    "Worm:Win32/Brontok@mm",
    "W32.Rontokbro@mm",
    "Email-Worm.Win32.Brontok",
    "Rontokbr"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the landmark Brontok (Rontokbr) worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Brontok was a prolific mass-mailing worm active since 2005 that spread via email, disabled system tools, and rebooted PCs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Brontok spread across networks and systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It harvests email addresses from local files to send mass spam, and copies itself to USB drives and network shares."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Brontok cause computers to restart unexpectedly?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors active window titles and triggers an immediate reboot if users attempt to open tools like Registry Editor or cmd."
      }
    },
    {
      "@type": "Question",
      "name": "What system administrative tools are disabled by Brontok?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It disables Task Manager, Registry Editor (regedit), Folder Options, and system configuration utilities."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a computer infected with Brontok?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Safe Mode or use offline rescue media, run a full antimalware scan, and re-enable registry and task manager policies."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1091",
    "T1562.001",
    "T1547.001",
    "T1498",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and prevent the worm from traversing mapped network shares.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Disable AutoRun/AutoPlay enterprise-wide via Group Policy to halt Brontok's propagation via USB drives.",
    "Utilize offline registry editing tools or EDR to reverse the registry modifications that disabled `regedit.exe` and `cmd.exe`."
  ],
  "what_to_avoid": [
    "Do not insert a clean USB drive into the infected machine to transfer tools; Brontok will immediately infect the drive.",
    "Avoid assuming the threat is contained just by stopping the spam; the worm actively disables AV, leaving the machine vulnerable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Vandalism, Social Message Dissemination & DDoS Flooding",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2005,
  "threat_actor": "Brontok Worm Authors (Indonesian Origin)",
  "delivery_mechanism": [
    "Mass-Mailing Email Attachments (Internal SMTP Engine)",
    "Removable USB Media Replication",
    "Local Network Shared Folders"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows 2000"
  ],
  "capabilities": [
    "Internal SMTP Mass-Mailing Propagation",
    "Disabling Task Manager, Regedit, and Folder Options",
    "Automated Reboot on Diagnostic Window Detection",
    "USB Drive Auto-Replication",
    "DDoS Ping-Flooding Capabilities"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "HTML File (.html)",
      "Batch Script (.bat)"
    ],
    "network_signatures": [
      "Direct outbound SMTP connections on port 25 blasting spam emails",
      "High-volume ICMP/HTTP ping floods targeting configured victim websites"
    ],
    "evasion_techniques": [
      "Hooking window creation and terminating system utilities containing 'regedit' or 'cmd'",
      "Disabling Windows Folder Options to keep hidden system files invisible"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\tok-cirrhatus",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Bron-Spizaetus"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "High",
    "scope": "System administrative lockdown, unexpected reboot loops, widespread corporate network email congestion"
  },
  "lineage": {
    "derived_from": [
      "Historic Win32 Mass-Mailing Worm Architectures"
    ],
    "variants": [
      "Brontok.A",
      "Brontok.B@mm",
      "Rontokbro.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e",
      "1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f"
    ],
    "delivery": [
      "photo.zip.exe",
      "document_card.scr"
    ],
    "persistence": [
      "%AppData%\\locmgr.exe",
      "%UserProfile%\\Start Menu\\Programs\\Startup\\Empty.pif"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/Brontok@mm",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Brontok@mm"
    },
    {
      "name": "Kaspersky Securelist - Email-Worm.Win32.Brontok Analysis",
      "url": "https://securelist.com"
    }
  ]
}