{
  "family": "mydoom",
  "sample_count": 88,
  "category": "worm",
  "description": "Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fastest-spreading mass-mailing computer worms in internet history. First detected on January 26, 2004, Mydoom infected millions of computers worldwide, accounting for an estimated 25% of all global email traffic during its peak outbreak and prompting official emergency technical alerts from US-CERT (TA04-028A) and CISA. Distributed via deceptive email messages with spoofed senders and generic subject lines (e.g., 'Error', 'Status', 'Mail Delivery System'), Mydoom lured users into opening malicious attachments (.exe, .scr, .pif, .bat, or .zip). Once executed, Mydoom harvested email addresses from victim address books and local files (excluding security and educational domains) to broadcast mass copies via its own built-in SMTP engine. In addition to mass mailing, Mydoom opened an unauthorized listening backdoor on TCP ports 3127 through 3198 (specifically port 3127) and launched synchronized distributed denial-of-service (DDoS) SYN floods against the websites of the SCO Group and Microsoft.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Mydoom",
    "W32.Mydoom@mm",
    "W32.Novarg.A@mm",
    "WORM_MIMAIL.R"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Worm:Win32/Mydoom (Novarg)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mydoom is a historic mass-mailing email worm and backdoor that infected millions of PCs and caused historic email disruption in 2004."
      }
    },
    {
      "@type": "Question",
      "name": "Which network port was opened as a backdoor by Mydoom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mydoom opened an unauthorized listening backdoor on TCP port 3127 (and ports up to 3198) allowing remote code execution."
      }
    },
    {
      "@type": "Question",
      "name": "Which organizations were targeted by Mydoom's DDoS attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mydoom variants launched synchronized denial-of-service SYN floods against the SCO Group and Microsoft."
      }
    },
    {
      "@type": "Question",
      "name": "Has US-CERT / CISA issued official alerts regarding Mydoom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, US-CERT issued Technical Cyber Security Alert TA04-028A detailing Mydoom's propagation and remediation steps."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mydoom harvest email addresses for propagation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It scans Windows address books, browser temporary caches, and local text files for email strings, excluding certain vendor domains."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1204.002",
    "T1059.003",
    "T1547.001",
    "T1114.001",
    "T1498.001",
    "T1071.001"
  ],
  "cisa_advisory": "TA04-028A",
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection: Local Email Collection",
      "tactic": "Collection"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1036.004",
      "name": "Masquerading: Keep Original File Name",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the outbound mass-mailing campaign and sever the active backdoor listening on TCP 3127.",
    "Enforce egress firewall rules blocking outbound TCP port 25 from all endpoints, forcing all email traffic through authorized corporate mail relays.",
    "Utilize EDR or network scanners to identify any hosts with open, listening ports in the 3127-3198 range.",
    "Assume total endpoint compromise; perform a clean OS rebuild, as the backdoor was frequently used to install additional rootkits and malware."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'low severity' spam issue; the open backdoor provides full remote command execution to any attacker.",
    "Avoid assuming the threat is contained just by stopping the spam; ensure the initial vector is purged from all mailboxes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Disruption & Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2004,
  "threat_actor": null,
  "delivery_mechanism": [
    "Mass-Mailing Email Attachments (.exe, .scr, .pif, .zip)",
    "Spoofed Delivery Status Notifications",
    "Kazaa P2P File Sharing Folders"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows ME",
    "Windows 98",
    "Windows 95"
  ],
  "capabilities": [
    "Automated SMTP Mass Mailing",
    "Email Address Harvesting",
    "TCP Port 3127 Backdoor",
    "Distributed Denial-of-Service (DDoS) Flooding",
    "Antivirus Vendor Update Blocking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "ZIP Archive"
    ],
    "network_signatures": [
      "High-volume outbound SMTP traffic on TCP port 25",
      "Listening backdoor on TCP port 3127",
      "SYN floods targeting designated web server IP addresses"
    ],
    "evasion_techniques": [
      "Domain exclusion filtering (avoids government and security domains in early versions)",
      "Masquerading as system DLL (shimgapi.dll)"
    ],
    "persistence_mechanisms": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TaskMon",
      "Dropping shimgapi.dll into %System% directory"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "High",
    "scope": "Global mail infrastructure congestion, unauthorized listening backdoors, targeted DDoS outages"
  },
  "lineage": {
    "derived_from": [
      "Mimail Worm Family"
    ],
    "variants": [
      "Mydoom.A",
      "Mydoom.B",
      "Mydoom.M"
    ]
  },
  "iocs": {
    "file_hashes": [
      "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8",
      "1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e"
    ],
    "delivery": [
      "message.scr",
      "document.pif",
      "body.zip"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TaskMon",
      "C:\\Windows\\System32\\shimgapi.dll"
    ]
  },
  "sources": [
    {
      "name": "US-CERT / CISA Technical Alert TA04-028A - W32/Mydoom.A",
      "url": "https://www.cisa.gov/news-events/alerts/2004/01/28/w32mydooma"
    },
    {
      "name": "Huntress Threat Research - History of Mydoom",
      "url": "https://www.huntress.com/blog"
    }
  ]
}