{
  "family": "induc",
  "sample_count": 9,
  "category": "advanced_threat",
  "description": "Virus:Win32/Induc is a highly unique, fascinating, and historic file infector from 2009 that introduced a terrifying new vector for supply chain attacks. Instead of infecting random executable files, Induc specifically targeted software developers by infecting the **Delphi programming compiler** (versions 4 through 7). Once a developer's machine was infected, every single new, legitimate software program they compiled would automatically contain the Induc virus, turning innocent software vendors into unwitting malware distributors.<br><br><b>Understanding the Induc Virus</b><br>To an end-user, an Induc-infected file behaved perfectly normally, as the virus was largely benign and contained no destructive payload. For security analysts and software developers, Induc was a nightmare. It proved that trust in digitally signed, legitimate software could be fundamentally broken if the compiler itself was compromised. Countless legitimate applications worldwide were suddenly flagged as malware because their developers were infected with Induc.<br><br><b>Execution and Compiler Infection Mechanics</b><br>The infection began when a developer accidentally ran an executable that had been compiled on an already-infected machine (`T1204.002`). The virus would immediately search the registry for installations of Borland Delphi (`T1012`). If found, it navigated to the Delphi source folder and located a core library file named `SysConst.pas` (the source code for system constants). The virus injected its own malicious Delphi source code directly into `SysConst.pas` (`T1195`). It then invoked the Delphi command-line compiler to compile this modified file into a new `SysConst.dcu` (compiled unit). From that moment on, anytime the developer compiled *any* project, the Delphi linker would automatically include the malicious `SysConst.dcu`. Every output `.exe` became a carrier for the virus.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact was massive reputational damage to software vendors and a stark lesson in supply chain vulnerability. The IoC is the presence of the Induc signature within newly compiled Delphi executables. On the developer's machine, the key IoC is a modified `SysConst.pas` file containing malicious source code, and a recently compiled `SysConst.dcu` file in the Delphi library directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Induc and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Induc is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Induc establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Induc typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Induc compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Induc should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Induc leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Induc frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Induc maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Induc often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1012",
    "T1195",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1195",
      "name": "Supply Chain Compromise (Infecting the development compiler)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1012",
      "name": "Query Registry (Locating the Delphi installation)",
      "tactic": "Discovery"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "For end-users: Simply delete the infected executable; the virus does not actively harm the system or steal data.",
    "For Developers: Immediately stop distributing all software compiled on the infected machine.",
    "Developers must navigate to their Delphi `Lib` directory, delete the maliciously compiled `SysConst.dcu`, and replace the `SysConst.pas` file with a clean backup from the installation media.",
    "Developers must completely recompile all software projects from clean source code to ensure the resulting binaries are free of the virus."
  ],
  "what_to_avoid": [
    "Do not assume the software vendor intentionally distributed malware; they were likely victims of the compiler infection.",
    "Avoid simply cleaning the output `.exe`; the developer's environment remains compromised and will continue to generate infected files."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}