{
  "family": "netsky",
  "sample_count": 105,
  "category": "worm",
  "description": "Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global network congestion and computer disruptions. Authored by 17-year-old German high school student Sven Jaschan (who simultaneously authored the devastating Sasser worm), Netsky spread across the internet with unprecedented speed. The worm harvests email addresses from cached files across victim hard drives (.html, .eml, .txt, .doc) and utilizes its own built-in SMTP engine to send deceptive emails with forged sender addresses and enticing subject lines (such as 'Re: Details', 'Your password', or 'Delivery status'). Netsky also spreads across local network shares and peer-to-peer (P2P) file-sharing directories (such as Kazaa and eMule) using deceptive executable filenames. Notably, Jaschan programmed Netsky to wage a digital turf war against competing malware families Bagle and Mydoom, actively seeking out and removing Bagle and Mydoom registry entries and files from infected computers. In May 2004, German police in Lower Saxony arrested Jaschan following an international tip facilitated by Microsoft's Anti-Virus Reward Program ($250,000 bounty), leading to Jaschan's conviction for computer sabotage.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Netsky",
    "Worm.Win32.Netsky",
    "W32/Netsky",
    "Win32.Netsky",
    "Moodown"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Netsky worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Netsky was a fast-spreading mass-mailing worm that infected millions of computers worldwide in 2004 via email and peer-to-peer networks."
      }
    },
    {
      "@type": "Question",
      "name": "Who wrote the Netsky worm?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Netsky was written by 17-year-old German student Sven Jaschan, who was also responsible for creating the Sasser worm."
      }
    },
    {
      "@type": "Question",
      "name": "How was Sven Jaschan captured?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jaschan was arrested by German police in May 2004 following an informant tip rewarded by Microsoft's $250,000 Anti-Virus Reward Program."
      }
    },
    {
      "@type": "Question",
      "name": "What was the malware 'turf war' between Netsky, Bagle, and Mydoom?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Jaschan coded Netsky to actively find and delete registry keys, processes, and files of rival worms Bagle and Mydoom, claiming to clean infected computers."
      }
    },
    {
      "@type": "Question",
      "name": "How did Netsky propagate without an email client?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Netsky contained its own internal SMTP engine, allowing it to connect directly to recipient mail servers to deliver forged emails."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1114.001",
    "T1021.002",
    "T1071.003",
    "T1560.001",
    "T1059.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactic": "initial-access"
    },
    {
      "id": "T1114.001",
      "name": "Email Collection",
      "tactic": "collection"
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1071.003",
      "name": "Mail Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1560.001",
      "name": "Archive via Utility",
      "tactic": "collection"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "execution"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2004,
  "lineage": {
    "derived_from": [],
    "variants": [
      "netsky.a",
      "netsky.b",
      "netsky.c",
      "netsky.d (peak outbreak)",
      "netsky.p",
      "netsky.z"
    ]
  },
  "attribution": [
    {
      "actor": "Sven Jaschan (Author, Germany)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2001-0154",
    "CVE-2004-0115"
  ],
  "c2_profile": {
    "protocols": [
      "SMTP",
      "P2P",
      "TCP"
    ],
    "ports": [
      25,
      139,
      445
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "3333333333333333333333333333333333333333333333333333333333333333",
      "4444444444444444444444444444444444444444444444444444444444444444"
    ],
    "delivery": [
      "mass_mailing_smtp",
      "p2p_file_sharing"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Win.ini run="
    ]
  },
  "sources": [
    {
      "name": "Microsoft DCU: Sven Jaschan Anti-Virus Reward Case Summary",
      "url": "https://blogs.microsoft.com/"
    },
    {
      "name": "German Federal Criminal Police Office (BKA) Netsky Investigation",
      "url": "https://www.bka.de/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2004-0115",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0115"
    }
  ],
  "containment_steps": [
    "Block outbound direct port 25 SMTP traffic from user endpoints to stop worm propagation.",
    "Deploy email gateway filters inspecting executable attachments with double extensions (.pif, .scr, .exe).",
    "Disable open writable network shares across corporate subnets.",
    "Apply security patch MS04-011 for LSASS vulnerability CVE-2004-0115."
  ],
  "what_to_avoid": [
    "Do not allow direct outbound port 25 access from client subnets without relaying through trusted mail servers.",
    "Avoid opening unsolicited email attachments ending in .pif, .scr, or .cmd.",
    "Do not operate unauthenticated file-sharing services across untrusted networks."
  ],
  "target_industries": [
    "consumers",
    "education",
    "corporate_networks",
    "telecommunications"
  ],
  "motivation": "Digital Vandalism & Malware Turf War",
  "threat_actors": [
    "Sven Jaschan"
  ],
  "target_geographies": [
    "DE",
    "US",
    "GB",
    "FR",
    "JP",
    "AU"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "collection",
    "lateral-movement"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}