{
  "family": "hpdefender",
  "sample_count": 109,
  "category": "rogue_antivirus",
  "description": "Hpdefender (cataloged across antivirus telemetry as Rogue:Win32/HpDefender, Trojan:Win32/HpDefender, and Rogue.HpDefender) is an aggressive rogue security program and scareware family active since 2010. Mimicking legitimate computer security suites from major PC manufacturers and Windows Defender, Hpdefender was distributed via exploit kits, malicious advertising (malvertising), and deceptive software download portals. Once installed on a Windows workstation, Hpdefender hijacks system controls, immediately terminating active processes belonging to legitimate antimalware vendors and altering registry keys to disable administrative utilities—specifically blocking Windows Task Manager (DisableTaskMgr) and the Registry Editor (DisableRegistryTools). The scareware bombards the user with fabricated critical infection popups, false hard drive failure alerts, and simulated malware scan animations. It locks user access to legitimate executable files and web browsers, demanding immediate credit card payment for a 'commercial license key' to clean the nonexistent infections.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rogue:Win32/HpDefender",
    "Trojan:Win32/HpDefender",
    "Rogue.HpDefender",
    "Win32/HpDefender"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Rogue:Win32/HpDefender scareware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Hpdefender is a rogue antivirus program that displays fabricated security warnings to extort money for fake cleanup licenses."
      }
    },
    {
      "@type": "Question",
      "name": "How does Hpdefender restrict administrative control on infected PCs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sets registry policies to disable Task Manager (DisableTaskMgr) and Registry Editor (DisableRegistryTools) and blocks executables."
      }
    },
    {
      "@type": "Question",
      "name": "What distribution methods were used by Hpdefender?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through drive-by downloads, compromised websites, fake video codec prompts, and exploit kits."
      }
    },
    {
      "@type": "Question",
      "name": "What should a user do if they paid the scareware fee?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Immediately contact their financial institution or credit card provider to dispute the charge, cancel the card, and monitor for fraud."
      }
    },
    {
      "@type": "Question",
      "name": "How can Hpdefender be eradicated from Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reboot into Windows Safe Mode, deploy an offline antimalware scanner like Malwarebytes, and repair registry system policies."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1491.001",
    "T1189",
    "T1204.002",
    "T1547.001",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Restart the infected endpoint into Windows Safe Mode with Networking disabled to suppress scareware autostart routines.",
    "Execute an offline antimalware remediation scanner (such as Microsoft Defender Offline or Malwarebytes) to purge rogue executables.",
    "Restore administrative access by resetting the DisableTaskMgr and DisableRegistryTools registry policy values.",
    "Advise victims who entered credit card details to contact their banking provider immediately to cancel compromised cards."
  ],
  "what_to_avoid": [
    "Do not pay for the fraudulent registration fee, as the scareware provides zero security functionality and captures payment data.",
    "Avoid assuming the system is clean once pop-ups stop, as rogue AV droppers frequently install hidden secondary trojans."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "motivation": "Fraudulent Extortion",
  "threat_actors": [
    "Rogue AV Syndicates",
    "Scareware Operators"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2010,
  "lineage": {
    "derived_from": [
      "WinWebSec Rogue Antivirus Family"
    ],
    "variants": [
      "HpDefender 2010",
      "HpDefender Pro",
      "System Defender 2011"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d",
      "6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e"
    ],
    "delivery": [
      "Drive-by downloads from compromised websites and malvertising",
      "Fake multimedia codec prompts and SEO poisoning landing pages"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\HpDefender",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Rogue:Win32/HpDefender",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rogue:Win32/HpDefender"
    },
    {
      "name": "BleepingComputer Removal Guide - Rogue HP Defender Scareware",
      "url": "https://www.bleepingcomputer.com/virus-removal/remove-hp-defender"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}