{
  "family": "lovgate",
  "sample_count": 15,
  "category": "worm",
  "description": "Lovgate (historically documented across cybersecurity research as Worm:Win32/Lovgate, Email-Worm.Win32.Lovgate, and Backdoor:Win32/Lovgate) is a landmark mass-mailing email worm and backdoor family active since the early 2000s. Lovgate spreads aggressively by scanning local network subnets for open administrative network shares (C$, ADMIN$) with weak passwords and utilizing its own embedded SMTP engine to dispatch infected email replies to unread messages in Microsoft Outlook and Windows Address Book. Upon infection, Lovgate opens a hidden backdoor listener on TCP ports (such as 20168), enabling remote attackers to execute arbitrary console commands, upload and download files, terminate processes, and capture keystrokes. Lovgate ensures persistence by adding entries to HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Lovgate",
    "Email-Worm.Win32.Lovgate",
    "Backdoor:Win32/Lovgate",
    "Win32/Lovgate",
    "I-Worm.Lovgate",
    "Lovgate Worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Lovgate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lovgate is a classic mass-mailing email worm and backdoor that spreads via infected emails and open Windows network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lovgate spread via email?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses an embedded SMTP engine to automatically reply to unread messages in Outlook, attaching a copy of itself disguised as an update."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lovgate spread across local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans subnets for open administrative shares (C$, ADMIN$) and attempts brute-force authentication using a built-in password list."
      }
    },
    {
      "@type": "Question",
      "name": "What backdoor capabilities does Lovgate provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It opens a TCP listener allowing attackers to execute commands, transfer files, log keystrokes, and terminate security processes."
      }
    },
    {
      "@type": "Question",
      "name": "How is Lovgate cleaned from infected endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Terminate the worm process, remove the registry Run entries, close open administrative shares, and scan with antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1021.002",
    "T1547.001",
    "T1056.001",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1534",
      "name": "Internal Spearphishing",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt the aggressive SMTP spamming and the local SMB scanning/lateral movement.",
    "Block the specific backdoor TCP port (e.g., 10168) at the enterprise firewall to sever the attacker's remote control capabilities.",
    "Audit all network shares (IPC$, ADMIN$) to ensure strong passwords are enforced, preventing the worm's dictionary attack propagation.",
    "Use an enterprise anti-malware tool to locate and remove the worm executable from the Windows System directory and strip the Registry Run keys."
  ],
  "what_to_avoid": [
    "Do not leave the machine on the network while attempting manual removal; the worm will continue to spam contacts and attack other internal hosts.",
    "Avoid relying on weak or default local administrator passwords, as these are the primary targets for Lovgate's network spreading module."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Worm:Win32/Lovgate",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Lovgate"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - WORM_LOVGATE Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_lovgate"
    },
    {
      "name": "MITRE ATT&CK - Remote Services: SMB/Windows Admin Shares (T1021.002)",
      "url": "https://attack.mitre.org/techniques/T1021/002/"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}