{
  "family": "cycbot",
  "sample_count": 8,
  "category": "ransomware",
  "description": "Backdoor:Win32/Cycbot is a notorious, highly persistent botnet agent and backdoor primarily known for executing massive click-fraud campaigns and hijacking search engine results. Initially discovered around 2010, Cycbot infects endpoints to forcefully route the victim's web traffic through attacker-controlled proxies, generating illicit revenue by simulating clicks on paid advertisements and acting as a conduit for secondary malware.<br><br><b>Understanding the Cycbot Botnet</b><br>To an end-user, a Cycbot infection manifests as severe browser instability, dramatically slowed internet speeds, and the constant redirection of their Google or Bing searches to irrelevant, ad-heavy websites. For a security analyst, Cycbot represents a severe compromise of network integrity. The malware effectively Man-in-the-Middles (MitM) the endpoint's web traffic, exposing the organization to data interception and acting as a persistent backdoor that the botmaster can use to deploy ransomware later.<br><br><b>Execution and Interception Mechanics</b><br>Cycbot is typically distributed via exploit kits or bundled with rogue software. Upon execution, it injects itself deeply into the `explorer.exe` process (`T1055`) to evade detection and establish a footprint. It ensures persistence by creating complex, randomly named Registry Run keys (`T1547.001`). The core functionality involves acting as a local proxy (`T1090`). Cycbot modifies the Windows network settings and hooks browser APIs (`T1185`) to intercept all HTTP/HTTPS traffic. When a user searches for a term, Cycbot queries its Command and Control (C2) server (`T1071.001`), which replies with a list of monetized URLs. Cycbot then seamlessly redirects the user's browser to these URLs, simulating legitimate ad clicks (`T1111`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, massive generation of fraudulent web traffic, and the potential for credential interception. Incident responders will observe anomalous outbound network traffic on standard web ports connecting to known Cycbot C2 infrastructure. Host-based IoCs include EDR alerts for process injection into `explorer.exe` and unauthorized modifications to the system's local proxy settings (e.g., altering the `ProxyServer` registry key).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Cycbot and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cycbot is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cycbot establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cycbot typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Cycbot compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Cycbot should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Cycbot employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cycbot typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Cycbot, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Cycbot depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1185",
    "T1111",
    "T1090"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection (Injecting into explorer.exe)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Intercepting search queries)",
      "tactic": "Collection"
    },
    {
      "id": "T1090",
      "name": "Proxy (Acting as a local proxy to route traffic)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception (Potentially intercepting secure traffic)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the botnet proxy can be used to intercept sensitive corporate data or download secondary payloads.",
    "Use EDR to locate the injected thread within `explorer.exe` and terminate it, then remove the randomized Registry persistence keys.",
    "Manually audit and reset the Windows local proxy settings (`inetcpl.cpl` -> LAN settings) to ensure traffic is no longer being routed through the malware.",
    "Block all identified Cycbot C2 domains and IP addresses at the enterprise firewall."
  ],
  "what_to_avoid": [
    "Do not assume the infection is 'just adware'; Cycbot is a full-featured backdoor capable of executing arbitrary commands from the botmaster.",
    "Avoid ignoring the network anomalies; the click-fraud traffic consumes significant bandwidth and degrades network performance."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}