{
  "family": "komodia",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "Rootkit:Win32/Komodia is a highly controversial software development kit (SDK) designed for network interception and SSL/TLS decryption. Komodia is most infamous for being the underlying technology behind the **'Superfish'** adware scandal, where it was discovered pre-installed on Lenovo laptops in 2015. While marketed to parental control and ad-injection companies as a way to monitor encrypted web traffic, its implementation acts exactly like a malicious rootkit and fundamentally breaks the security model of the internet on infected endpoints.<br><br><b>Understanding the Komodia (Superfish) Threat</b><br>To an end-user, Komodia is invisible, though they might notice unexpected advertisements appearing on secure websites like Google or their bank. For a security analyst, Komodia is a catastrophic vulnerability. To intercept encrypted HTTPS traffic, Komodia installs a self-signed root certificate authority (CA) into the Windows certificate store and acts as a local Man-in-the-Middle (MitM) proxy. The fatal flaw was that all installations of Komodia shared the *exact same private key* for this root certificate.<br><br><b>Execution and TLS Interception Mechanics</b><br>Komodia is typically bundled with adware (like Superfish) or aggressive parental control software (`T1189`). Upon execution, it installs a local proxy service (`T1543.003`) and reroutes all endpoint web traffic through it (`T1562.004`). Crucially, it forces the installation of its own root CA into the Trusted Root Certification Authorities store (`T1553.004`). When a user visits a secure site (like `https://bank.com`), the Komodia proxy intercepts the connection, decrypts the traffic (`T1185`), injects ads or logs the data, and then re-encrypts the connection to the browser using a dynamically generated certificate signed by its fake root CA. Because the private key was hardcoded and easily extracted, *any* attacker on the same network (e.g., a public Wi-Fi hotspot) could use that key to completely spoof any secure website, bypassing all browser security warnings.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete destruction of endpoint TLS security and the exposure of all passwords, banking details, and secure communications. The primary IoC is the presence of unauthorized root certificates in the Windows Certificate Manager (`certmgr.msc`) (specifically looking for 'Superfish, Inc.' or 'Komodia'). Network analysts will observe all HTTPS traffic originating from the endpoint being proxied through `localhost` before exiting the network.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Komodia and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Komodia is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Komodia establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Komodia typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Komodia compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Komodia should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Komodia leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Komodia frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Komodia maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Komodia often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1553.004",
    "T1562.004",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1553.004",
      "name": "Subvert Trust Controls: Install Root Certificate (Breaking TLS)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Rerouting traffic to local proxy)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Middle interception)",
      "tactic": "Collection"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (The local proxy engine)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Identify and completely uninstall the software utilizing the Komodia SDK (e.g., Superfish, KeepMyFamilySecure, Kurupira).",
    "CRITICAL: Uninstalling the software does NOT remove the root certificate. You must manually open `certmgr.msc` and delete the compromised root CA from the 'Trusted Root Certification Authorities' store.",
    "Run Microsoft's dedicated Malicious Software Removal Tool (MSRT) or an enterprise EDR solution specifically configured to hunt and strip Komodia certificates.",
    "Enforce a mandatory password reset for all accounts the user accessed while the software was active, as all HTTPS traffic was decrypted."
  ],
  "what_to_avoid": [
    "Do not assume uninstalling the parent adware fixes the vulnerability; the rogue root certificate remains and can be exploited by any attacker.",
    "Avoid ignoring the alert; even if the software was installed 'legitimately' for parental controls, the shared private key makes the endpoint highly vulnerable to interception."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}