{
  "family": "ngrbot",
  "sample_count": 110,
  "category": "worm",
  "description": "NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-propagating worm active since 2011. Operating at massive scale across more than 190 countries and infecting well over one million endpoints at its zenith, Dorkbot/NGRBot was the subject of official US-CERT/CISA Technical Alert TA15-337A and a coordinated international law enforcement takedown involving Microsoft, Interpol, and the FBI. Built around an IRC-based command-and-control core, NGRBot propagates rapidly via removable USB storage devices (using infected LNK shortcuts and autorun hooks), peer-to-peer messaging networks (Skype, Windows Live Messenger), and social media phishing links. Once active on a host, NGRBot performs API-hooking and browser form-grabbing to intercept login credentials, online banking sessions, and email passwords. It also includes denial-of-service (DDoS) flood modules and systematically disables antivirus updates and security software domains by altering the local DNS resolution and Windows HOSTS configuration.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Worm:Win32/Dorkbot",
    "Worm.Win32.Ngrbot",
    "NGRBot",
    "Dorkbot",
    "W32.IRCBot.NG",
    "Win32/Dorkbot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the NGRBot / Dorkbot malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NGRBot (Dorkbot) is an IRC-based worm and botnet that stole online banking credentials and infected over 1 million PCs worldwide."
      }
    },
    {
      "@type": "Question",
      "name": "What government advisory was issued for Dorkbot?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "US-CERT / CISA issued official Technical Alert TA15-337A detailing Dorkbot's botnet architecture, spreading routines, and mitigation."
      }
    },
    {
      "@type": "Question",
      "name": "How does NGRBot propagate across Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads via infected USB flash drives using shortcut tricks, instant messaging clients, and social engineering download links."
      }
    },
    {
      "@type": "Question",
      "name": "What credential theft techniques does NGRBot employ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks web browser network APIs and performs in-memory form grabbing to intercept user credentials before encryption."
      }
    },
    {
      "@type": "Question",
      "name": "How was the Dorkbot botnet disrupted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A coordinated international operation led by Microsoft, Interpol, the FBI, and national CERTs sinkholed C2 domains in 2015."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1055",
    "T1056.004",
    "T1498",
    "T1562.001",
    "T1105"
  ],
  "cisa_advisory": "TA15-337A",
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.004",
      "name": "Input Capture: Credential API Hooking",
      "tactic": "Credential Access"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from network and internet access to sever IRC command-and-control communications.",
    "Initiate organization-wide password resets for any corporate or financial accounts accessed from the infected host.",
    "Examine and clean all removable USB storage devices connected to the endpoint to halt physical worm propagation.",
    "Revert malicious modifications to the Windows HOSTS file and registry DNS configurations blocking security vendors."
  ],
  "what_to_avoid": [
    "Do not connect clean USB drives to an infected system, as Dorkbot instantly writes malicious autorun files and hidden LNKs.",
    "Avoid assuming credential compromise was limited to banking, as the botnet logs all browser and messaging credentials."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Banking and Financial Services",
    "Consumer Endpoints"
  ],
  "motivation": "Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Dorkbot Botnet Operators"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "lateral_movement",
    "credential_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "lineage": {
    "derived_from": [
      "Classic IRC Worms"
    ],
    "variants": [
      "Dorkbot.A",
      "Dorkbot.B",
      "NGRBot 2.0"
    ]
  },
  "iocs": {
    "file_hashes": [
      "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f",
      "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a"
    ],
    "delivery": [
      "Infected USB removable media with weaponized LNK shortcuts",
      "Malicious download links sent via Skype and instant messaging"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Ngrbot",
      "Injected process threads inside explorer.exe"
    ]
  },
  "sources": [
    {
      "name": "CISA / US-CERT Alert TA15-337A - Dorkbot Botnet",
      "url": "https://www.cisa.gov/news-events/alerts/2015/12/03/dorkbot-malware"
    },
    {
      "name": "Microsoft Security Blog - Defeating the Dorkbot Botnet",
      "url": "https://www.microsoft.com/en-us/security/blog/2015/12/03/defeating-the-dorkbot-botnet/"
    },
    {
      "name": "Huntress Threat Intel - Dorkbot / NGRBot Overview",
      "url": "https://www.huntress.com/threat-library/dorkbot"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}