{
  "family": "koobface",
  "sample_count": 350,
  "category": "worm",
  "description": "Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable botnets between 2008 and 2012. Authored by a dedicated Russian cybercrime group known as the 'Koobface Gang' (Ali-Baba), the worm propagated across major social networking platforms including Facebook, MySpace, Twitter, Bebo, and Friendster. It hijacked compromised social media accounts to broadcast deceptive video lures to the victim's friends (such as 'You look so funny in this video!'). Clicking the link directed users to deceptive third-party landing pages mimicking YouTube, which prompted the download of a fraudulent executable masquerading as a required Flash Player update. Once executed, Koobface functioned as a modular, multi-tier crimeware machine: it installed a local HTTP proxy server that routed affiliate traffic, bypassed automated CAPTCHA challenges by relaying images to free adult sites where unsuspecting users solved them, hijacked search engine query results to display affiliate advertisements, and installed rogue antivirus (scareware) suites to extract fraudulent credit card payments.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Koobface Botnet",
    "Worm:Win32/Koobface",
    "Net-Worm.Win32.Koobface",
    "Bagle.Koobface"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Koobface worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Koobface was a notorious social media worm and botnet that propagated through automated messaging on Facebook, MySpace, and Twitter, monetizing infections through click-fraud and rogue antivirus."
      }
    },
    {
      "@type": "Question",
      "name": "How did Koobface bypass CAPTCHA protections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Koobface famously engineered an automated CAPTCHA relay system that redirected social network verification images to free adult websites, where external visitors solved them unwittingly."
      }
    },
    {
      "@type": "Question",
      "name": "How did the Koobface operators make money?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The operators monetized the botnet by running paid pay-per-click advertising fraud, redirecting search results to sponsor sites, and scaring victims into buying fake rogue antivirus licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Who was behind the Koobface botnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Independent security researchers (led by Jan Droemer) unmasked the core perpetrators in St. Petersburg, Russia (known as the Koobface Gang or Ali-Baba team)."
      }
    },
    {
      "@type": "Question",
      "name": "How was Koobface removed from infected computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Removing Koobface required terminating its proxy components, cleaning autostart registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and resetting system DNS settings altered by the worm."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1059.003",
    "T1547.001",
    "T1090.003",
    "T1185",
    "T1112",
    "T1071.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactic": "initial-access"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactic": "persistence"
    },
    {
      "id": "T1090.003",
      "name": "Multi-hop Proxy",
      "tactic": "command-and-control"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "collection"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-16",
  "first_seen": 2008,
  "lineage": {
    "derived_from": [
      "bagle mass mailer concepts"
    ],
    "variants": [
      "koobface.a",
      "koobface proxy botnet",
      "koobface captcha relay build"
    ]
  },
  "attribution": [
    {
      "actor": "Koobface Gang (Ali-Baba)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "P2P Proxy Mesh"
    ],
    "ports": [
      80,
      8080
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "9f8a32b6e8a71927361819203648192847291827491028374910283749102834",
      "8e71629401726354819203746192847192847192847192847192847192847192"
    ],
    "delivery": [
      "social_media_messaging",
      "fake_flash_player_installers",
      "deceptive_video_links"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Browser Helper Objects (BHO)"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Securelist: The Koobface Botnet In-Depth Architectural Analysis",
      "url": "https://securelist.com/the-koobface-botnet/36287/"
    },
    {
      "name": "Trend Micro Research: Koobface Gang Unmasked",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/koobface"
    },
    {
      "name": "Sophos Security: Dissecting the Koobface Social Networking Worm",
      "url": "https://news.sophos.com/en-us/2012/01/17/koobface-gang-exposed/"
    }
  ],
  "containment_steps": [
    "Terminate active malicious proxy services and delete rogue executable binaries in AppData and Temp.",
    "Remove persistent registry run entries under CurrentVersion\\Run and browser helper objects.",
    "Reset network adapter DNS configurations to verified legitimate providers (e.g. 1.1.1.1 or 8.8.8.8).",
    "Force logout of all active social media and email sessions and invalidate browser cookies."
  ],
  "what_to_avoid": [
    "Do not execute video player or codec download prompts presented on untrusted web pages.",
    "Avoid sharing or forwarding unexpected video links received from compromised contacts.",
    "Never purchase antivirus subscriptions advertised through unexpected browser pop-ups."
  ],
  "target_industries": [
    "consumers",
    "social_media_users",
    "education"
  ],
  "motivation": "Click Fraud, Rogue Antivirus Monetization & Proxy Routing",
  "threat_actors": [
    "Koobface Gang"
  ],
  "target_geographies": [
    "GLOBAL",
    "US",
    "CA",
    "GB",
    "DE"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "collection",
    "command-and-control"
  ],
  "ecosystem": [
    "windows"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}