{
  "family": "cambot",
  "sample_count": 89,
  "category": "worm",
  "description": "CamBot (cataloged across security vendors as Worm:Win32/CamBot, Backdoor:Win32/CamBot, and Trojan:Win32/CamBot) is a hybrid Windows worm and remote access surveillance backdoor active since 2008. Frequently deployed in conjunction with multi-stage loaders and droppers (such as Ainslot and Cosgand), CamBot was engineered to establish persistent covert command-and-control while spreading across local networks. Once executed on an endpoint, CamBot interrogates network adapters, copies itself across accessible network shares, and infects removable storage media using autorun.inf techniques. CamBot establishes a persistent background Windows service, opens listening communication ports, and connects to remote C2 servers. The backdoor provides unauthorized attackers with arbitrary command execution, remote file upload/download, keystroke logging, and covert webcam video streaming capabilities, enabling extensive corporate and personal surveillance of infected victims.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/CamBot",
    "Backdoor:Win32/CamBot",
    "Trojan:Win32/CamBot",
    "Worm:Win32/CamBot.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/CamBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CamBot is a hybrid worm and remote access backdoor with surveillance capabilities including webcam streaming."
      }
    },
    {
      "@type": "Question",
      "name": "How does CamBot propagate across systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads by copying itself to open network shares and infecting connected removable USB drives."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does CamBot provide to attackers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can stream connected webcams, log keystrokes, capture screens, and execute remote shell commands."
      }
    },
    {
      "@type": "Question",
      "name": "Which malware droppers are known to deploy CamBot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security researchers have observed CamBot delivered by multi-stage loaders such as Ainslot and Cosgand."
      }
    },
    {
      "@type": "Question",
      "name": "How should administrators eradicate a CamBot infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the host from the network, terminate unauthorized background services, run full antimalware cleanup, and change user credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1543.003",
    "T1021.002",
    "T1091",
    "T1125",
    "T1056.001",
    "T1113",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Cambot payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Cambot persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access & Surveillance",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Network Share Propagation",
    "Removable USB Media (Autorun)",
    "Multi-stage Dropper Payloads (Ainslot)"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Network Share Propagation",
    "Webcam Surveillance Streaming",
    "Keystroke Logging",
    "Remote Command Execution",
    "Windows Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Windows Service Binary"
    ],
    "network_signatures": [
      "TCP traffic on custom command-and-control ports",
      "Outbound video streaming data streams to remote C2"
    ],
    "evasion_techniques": [
      "Service masquerading as legitimate Windows media components",
      "API unhooking and sleep delays"
    ],
    "persistence_mechanisms": [
      "Windows Service registration (services.exe)",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CamBot"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Webcam privacy, sensitive network files, unauthorized host command execution"
  },
  "lineage": {
    "derived_from": [
      "Win32 Remote Access Trojans"
    ],
    "variants": [
      "CamBot.A",
      "CamBot.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
      "f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7"
    ],
    "delivery": [
      "cambot_setup.exe",
      "media_service.exe"
    ],
    "persistence": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\CamBotService",
      "C:\\Windows\\System32\\cambot_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/CamBot",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/CamBot"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - WORM_CAMBOT.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_cambot.a"
    }
  ]
}