{
  "family": "chindo",
  "sample_count": 85,
  "category": "worm",
  "description": "Chindo (cataloged in security vendor threat telemetry under signatures including Worm:Win32/Chindo, Trojan:Win32/Chindo, and Worm:Win32/Chindo.SQ!MTB) is a hybrid Windows worm and backdoor first detected in 2012. Designed to achieve rapid lateral movement across unsegmented local networks, Chindo interrogates local network configuration, scans for accessible administrative and SMB file shares, and copies its executable payload disguised as common document and utility files. Furthermore, Chindo infects connected removable storage drives (USB thumb drives) by generating autorun.inf files and deceptive shortcut LNK files. Once executed on a compromised endpoint, Chindo registers autostart entries in the Windows Registry, connects to attacker-controlled command-and-control servers, and downloads secondary malware payloads including keystroke loggers, credential stealers, and remote access backdoors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Chindo",
    "Trojan:Win32/Chindo",
    "Win32/Chindo",
    "Worm:Win32/Chindo.SQ!MTB"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Chindo?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Chindo is a hybrid worm and trojan that spreads via local network shares and removable USB media."
      }
    },
    {
      "@type": "Question",
      "name": "How does Chindo spread across local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans for open Windows SMB network shares and copies itself as disguised document or setup executables."
      }
    },
    {
      "@type": "Question",
      "name": "Does Chindo infect removable flash drives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it creates autorun scripts and hidden executable copies on connected USB storage devices."
      }
    },
    {
      "@type": "Question",
      "name": "What risks exist if Chindo remains active on an endpoint?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers can deploy secondary malware including keyloggers and credential harvesters to steal sensitive accounts."
      }
    },
    {
      "@type": "Question",
      "name": "How should administrators eradicate a Chindo infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the host, scan connected USB drives, disable autorun, run full antimalware scans, and rotate passwords."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1021.002",
    "T1091",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Chindo frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Network Share Propagation",
    "Removable USB Storage Media",
    "Drive-by Downloads"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Network Share Self-Replication",
    "USB Media Infection (Autorun)",
    "Secondary Payload Downloading",
    "Host Reconnaissance",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "LNK Shortcut",
      "INF Configuration"
    ],
    "network_signatures": [
      "Outbound SMB scanning traffic on TCP port 445",
      "HTTP GET beacons fetching secondary malware binaries"
    ],
    "evasion_techniques": [
      "Double file extensions on removable storage (e.g. document.pdf.exe)",
      "Masquerading as system background utilities"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Chindo",
      "Startup folder shortcut creation"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Local network propagation, removable drive infection, secondary malware staging"
  },
  "lineage": {
    "derived_from": [
      "Generic Win32 Worms"
    ],
    "variants": [
      "Chindo.A",
      "Chindo.SQ!MTB"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a"
    ],
    "delivery": [
      "usb_setup.exe",
      "network_share_doc.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ChindoWorm",
      "%AppData%\\Chindo\\chindo_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/Chindo",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Chindo"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - WORM_CHINDO.A",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_chindo.a"
    }
  ]
}