{
  "family": "cyn",
  "sample_count": 5,
  "category": "file_infector",
  "description": "Cyn (cataloged across classical antivirus telemetry as Virus:DOS/Cyn and Virus:Win32/Cyn) is an early parasitic file infector originally engineered for MS-DOS environments and later observed impacting legacy 16-bit and 32-bit execution layers. The virus is implemented in concise x86 assembly, attaching its replication routine directly to uninfected .COM and .EXE host binaries within the active directory and system search paths. When an infected host executable is invoked, the virus intercepts program control at the entry point, traverses local file systems to locate target executables, and splices its parasitic code into the binary header or trailing slack space before returning execution to the legitimate application logic. While Cyn does not incorporate intentional data-destructive wiping mechanisms, rudimentary error-handling and improper relocations in certain variants frequently cause binary corruption, structural header misalignment, and unexpected system crashes. Cyn represents early parasitic replication techniques and is completely mitigated by modern operating system integrity controls and signature heuristics.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "DOS.Cyn",
    "Virus.DOS.Cyn.446",
    "Virus:Win32/Cyn",
    "Cyn.446",
    "Cyn.512"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Cyn file infector virus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cyn is an early x86 parasitic file infector virus that replicates by prepending or appending its code to executable files (.COM and .EXE)."
      }
    },
    {
      "@type": "Question",
      "name": "How does the Cyn virus propagate and infect executables?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "When an infected program runs, Cyn scans the local directory and PATH for clean executables and splices its malicious code into host headers."
      }
    },
    {
      "@type": "Question",
      "name": "Does Cyn cause permanent data loss or file corruption?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "While Cyn lacks an intentional payload wiper, flawed assembly code and relocation errors in early variants frequently corrupt infected executables."
      }
    },
    {
      "@type": "Question",
      "name": "What lineage and historical variants exist for Cyn?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Documented variants include Cyn.446 and Cyn.512, named after their respective compiled payload byte lengths in DOS environments."
      }
    },
    {
      "@type": "Question",
      "name": "Is Cyn dangerous to modern operating systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. Modern 64-bit Windows architectures, DEP, ASLR, and modern endpoint security controls render 16-bit DOS parasitic viruses obsolete and inert."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1027",
    "T1083"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    }
  ],
  "containment_steps": [
    "Isolate endpoints exhibiting parasitic file modification indicators to prevent lateral traversal.",
    "Scan and quarantine all infected host executables (.COM, .EXE) identified by antimalware heuristics.",
    "Restore corrupted host executables from verified clean application installers or known-good golden image backups.",
    "Audit shared network drives and legacy storage devices for residual infected binary artifacts."
  ],
  "what_to_avoid": [
    "Do not execute unidentified legacy binary files on production endpoints without hypervisor sandbox analysis.",
    "Avoid running unverified executable repair tools that may truncate headers and permanently destroy valid binary sections."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - Virus:DOS/Cyn Details",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/cyn"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Virus:DOS/Cyn.446",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:DOS/Cyn.446"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 1994,
  "motivation": "Technical Demonstration",
  "lineage": {
    "derived_from": [
      "Generic DOS Parasitic Infector"
    ],
    "variants": [
      "DOS.Cyn.446",
      "DOS.Cyn.512"
    ]
  },
  "exploited_cves": [],
  "iocs": {
    "file_hashes": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "3a1c8f42e2b9609a5b6ef9d592655bf9eb9a9e334a974b621e25e229c15d8f63"
    ],
    "delivery": [
      "Direct execution of infected MS-DOS .COM and .EXE host files",
      "Shared floppy disks, removable optical media, and legacy bulletin board system (BBS) software archives"
    ],
    "persistence": [
      "Parasitic code injection directly modifying executable file headers and entry point vectors"
    ]
  },
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}